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Naval Engineer 
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Abstract 

A renewed interest in new nuclear power generation in the United States has spurred interest 
in developing advanced reactors with features which will address the public's concerns regarding 
nuclear generation. However, it is economic performance which will dictate whether any new 
orders for these plants will materialize. Economic performance is, to a great extent, improved 
by maximizing the time that the plant is on-line generating electricity relative to the time spent 
off-line conducting maintenance and refueling. Indeed, the strategy for the advanced light water 
reactor plant IRIS (International Reactor, Innovative & Secure) is to utilize an eight year operating 
cycle. 

This thesis has developed a formalized strategy to address, during the design phase, the 
maintenance-related barriers to an extended operating cycle. The top-level objective of this thesis 
was to develop a methodology for injecting component and system maintainability issues into the 
reactor plant design process to overcome these barriers. A primary goal was to demonstrate the 
applicability and utility of the methodology in the context of the IRIS design. 

The first step in meeting the top-level objective was to determine the types of operating cy¬ 
cle length barriers that the IRIS design team is likely to face. Evaluation of previously identified 
regulatory and investment protection surveillance program barriers preventing a candidate oper¬ 
ating PWR from achieving an extended (48 month) cycle was conducted in the context of the IRIS 
design. From this analysis, 54 known IRIS operating cycle length barriers were identified. The res¬ 
olution methodology was applied to each of these barriers to generate design solution alternatives 
for consideration in the IRIS design. 

The methodology developed has been demonstrated to narrow the design space to feasible 
design solutions which enable a desired operating cycle length, yet is general enough to have 
broad applicability. Feedback from the IRIS design team indicates that the proposed solutions to 
the investigated operating cycle length barriers are both feasible and consistent with sound design 
practice. 

Thesis Supervisor: Neil E. Todreas 
Title: Professor of Nuclear Engineering 

Thesis Reader: Clifford A. Whitcomb 
Title: Research Scientist 
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Chapter 1 


Introduction 

1.1 Impetus 

The deregulation of the electric power industry is part of the ongoing national trend to dereg¬ 
ulate major industries such as the airlines, telecommunications, and natural gas. The National 
Energy Policy Act of 1992 allows for the sale of electricity on the open market and for customers 
to choose their supplier. Also, Federal Energy Regulatory Commission (FERC) Order 888, "Pro¬ 
moting Wholesale Competition Through Open Access Non-discriminatory Transmission Services 
by Public Utilities, Recovery of Stranded Costs by Public Utilities and Transmitting Utilities," is¬ 
sued in 1996, requires that utility and non-utility generators have open access to the electric power 
transmission system. It is these stranded costs,^ or more specifically the need to avoid them, that 
has motivated the nuclear power industry to develop strategies to improve its economic perfor¬ 
mance. Only by pursuing these strategies will the nuclear industry guarantee its short term sur¬ 
vival, and position itself for long term growth in the deregulated environment. 

Conventionally fueled power plants start with an immediate economic advantage over nu¬ 
clear plants because of lower capital costs. Non-nuclear power plants typically have a shorter 
construction schedule and lower construction costs, allowing the investors to begin recovering 
their smaller capital investment sooner. Non-nuclear power plants also benefit from a lack of 
up front decommissioning costs, less regulatory costs, and (typically) much smaller plant staffing 

’stranded costs are investments or assets owned by regulated electric utilities that are likely to become inefficient or 
uneconomic in a competitive marketplace. 





levels. Nuclear plants, however, have a clear advantage over all major electric power produc¬ 
ing competitors: significantly lower fuel costs. But a nuclear power plant's lower fuel costs can 
only offset the higher capital costs if the amount of time spent on-line producing electricity at full 
capacity significantly exceeds the number of days spent shutdown. 

The term typically used to measure the economic performance of a nuclear power plant is 
unit capability factor. Unit capability factor^ is the percentage of maximum electricity generation 
that a plant is capable of supplying to the electrical grid, limited only by factors within plant 
management's control. Since U.S. nuclear power plants are typically operated at full power, the 
unit capability factor is directly related to the ratio of on-line days to on-line plus off-line days 
during any given period. Clearly, then, to improve the unit capability factor the on-line days must 
increase, the off-line days must decrease, or both. This can be accomplished by focusing on three 
general areas: 

• Increasing the cycle length between refuelings, 

• Minimizing refueling and planned maintenance outage times, and 

• Reducing the frequency and duration of forced outages. 

It should be noted that these three areas are not independent. Increasing the cycle length requires 
more maintenance to either be conducted on-line^ or deferred to the refueling outage. However 
deferring maintenance actions increases the probability of a component failure (which might have 
otherwise been detected at a shorter maintenance interval) causing a forced outage. 

Currently operating pressurized water reactor (PWR) plants are aggressively working to im¬ 
prove their economic performance by optimizing the operating cycle length. When these plants 
were built most operated on fuel cycles as short as 12 months. Today, many operate on an 
18 month cycle and some are transitioning to fuel cycles as long as 24 months. The plant mainte¬ 
nance strategy was developed to support the initial shorter fuel cycle and then modified to support 
the longer cycle lengths. However, these plants were not built with components that support an 
extended fuel cycle since it was not foreseen that the nuclear power industry would struggle to 

^As defined by the World Association of Nuclear Operators (WANO) and the Institute of Nuclear Power Operators 
(INPO). 

^On-Ime performance of a maintenance or testing action on a component means that the plant is still at power. 
The component may be on-service, isolated from it's system, or secured during this period. Off-line performance of a 
maintenance or testing action on a component means that the plant is shutdown. 



remain economically competitive. Regardless of advances in core design, which have been sig¬ 
nificant, the unit capabilty factor (and, hence, economic competitiveness) of currently operating 
PWR plants will be limited by the performance and maintenance requirements of the installed 
equipment. 

A rapid increase and peak of conventional fuel costs in late 2000 and into early 2001 has been 
a significant factor in the renewal of interest in nuclear generation. Although there are certified 
PWR designs available (e.g., the Westinghouse AP600 and System 80+ pressurized water reac¬ 
tors), public concerns for improved passive safety, proliferation resistance, and spent fuel disposal 
have stimulated new advanced reactor plant designs which address these issues. One strategy to 
ensure proliferation resistance and potentially reduce the amount of spent fuel generated is to use 
a fuel cycle much longer than that of currently operating plants, on the order of five to ten years. 
Economically, there are advantages to matching the maintenance cycle to this longer fuel cycle. 

1.2 The Need for a Design Methodology 

Reactor plant designers working on the next generation of nuclear power plants must work 
aggressively to eliminate or mitigate the limitations of the currently operating (legacy) plants. 
Clearly, then, maintainability must be an important design objective. However, there is currently 
no methodology for integrating component and system maintainability issues into the reactor 
plant design process. This thesis will develop such a methodology, and the methodology will 
be applied to the selection and design of components whose maintenace requirements have been 
identified as potential operating cycle length barriers for an advanced light water reactor plant. 

1.3 International Reactor, Innovative & Secure 

The advanced light water reactor plant to which this design methodology will be applied is 
the International Reactor, Innovative & Secure (IRIS). IRIS is currently being developed by an in¬ 
ternational consortium, led by Westinghouse and including universities (University of California 
at Berkeley, Massachusetts Institute of Technology, Polytechnic of Milan), laboratories, industry 
(Bechtel, Mitsubishi Heavy Industries) and utilities (Japan Atomic Power Company, Tennessee 
Valley Authority). The nucleus of the effort was provided by the Department of Energy (DOE) 
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Nuclear Energy Research Initiative (NERI) program which funds the U.S. participants. The orig¬ 
inal NERI program has attracted international interest and with strong impetus from Italy and 
Japan has been transformed into a full-fledged international effort to develop a next generation 
reactor. The main characteristics of IRIS are: 

• Enhanced safety systems . Utilization of a single, integrated, self-pressurized vessel and en¬ 
hanced safety systems with passive safety features making severe accidents leading to core 
damage impossible. The integral configuration eliminates the possibility of loss of coolant 
accidents of significant entity, and the reactor is designed for a very high level of natural 
circulation, thus eliminating the loss of flow accident. 

• Proliferation resistance . The core lifetime is projected to be on the order of eight years with¬ 
out fuel shuffling or refueling. Maintenance of the nuclear system is minimized and the goal 
is to design a reactor island which does not need to be accessed by the operator over the 
eight-year core lifetime.^ 

• Simple and economical . The capital cost is reduced because of the elimination of entire sys¬ 
tems such as refueling, soluble neutron absorber, and emergency core cooling; the use of a 
single, integrated, self-pressurized vessel; and, simplifications throughout the plant, e.g. re¬ 
duction in piping and valves. The operations and maintenance (O&M) cost is substantially 
reduced by the condition-based maintenance strategy, no partial refuelings (which will also 
increases the availability factor), and the use of modular, easily replaceable components. 

• Environmentally friendly . Because of the very long life of the core the amount of radioactive 
waste spent fuel is drastically reduced (of the order of five times less than current reactors 
for the same power output). A possibility which will be considered is to dispose of the vessel 
'in toto' (i.e., without removing the fuel) which would provide an additional barrier to the 
escape of radioactive products. 

^In late 2000, partly based on input from this investigation, the IRIS operating strategy was changed from a ten 
year cycle to an eight-year cycle with, if necessary, a maintenance shutdown at the midpoint of the cycle. This strategy 
meets the NERI proliferation resistance objective of no operator access to the fuel since vessel head removal will only 
be required every other outage. In early 2001, the first core lifetime was changed from high enrichment to low (about 
5%) enrichment due to enrichment facility licensing issues. As of April 2001, the first core lifetime is projected to be on 
the order of five years. 
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1.4 Goals and Objectives 


The top-level objective of this thesis is to develop a methodology for injecting component and 
system maintainability issues into the reactor plant design process. However, it is recognized 
that the design process must consider many factors other than just maintainability. Therefore, the 
methodology developed must not simply identify the "best" design alternative based on maintain¬ 
ability considerations but rather must qualitatively rank proposed alternatives based on overall 
maintainability. Using this approach, the design methodology will find greater utility since other 
factors (such as cost) may have a higher design priority but knowledge of the impact of these other 
factors on maintainability will be possible. 

The methodology is intended to be general enough to have broad applicability, yet descriptive 
enough to ensure that all relevant maintainability factors are considered. It carmot, nor is it in¬ 
tended to, replace the creative element in design. Rather, the methodology is intended simply to 
focus the creative design effort on those factors which are relevant to the process. Application of 
the methodology will be illustrated by considering several barriers identified in the IRIS concept 
design. 
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Chapter 2 


Design Methodology Framework 

2.1 Introduction 

The design methodology which this thesis seeks to develop can be viewed as a four-step pro¬ 
cess, shown graphically in Figure 2-1. The first step is the synthesis of the general requirements 
that the component must satisfy, which is a non-trivial task based on both experience and judge¬ 
ment. The second step is the synthesis of the design objectives with the design requirements. 
The third step is to boimd the solution space by application of suitable and relevant constraints. 
The final step is to develop design alternatives which meet the specifications of the synthesized 
design requirements, objectives, and constraints. This chapter presents a brief description of the 
components of the methodology. Following chapters explore the inputs, present the methodol¬ 
ogy 'engine' in detail, and demonstrate application of the methodology to several identified IRIS 
maintenance-related barriers. 

2.2 Methodology Inputs 

The primary inputs to the methodology 'engine' are shown graphically in Figure 2-1. These 
inputs are intended to encompass those factors most relevent to component and system design. 
Starting from Functional Requirements and working down (see Figure 2-1), the inputs are ordered 
such that each successive step in the requirements optimization engine serves to further define the 
solution space in terms of all previous inputs. The exceptions are the inputs emerging materials and 
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Figure 2-1: 'Requirements Optimization Engine' Concept 
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emerging technologies, which broaden the solution space by considering future capabilities rather 
than focusing solely on current capabilities. 

2.2.1 Functional Requirements 

First and foremost, the functional requirements that the component must meet need to be 
specified in the most explicit terms possible without introducing bias towards current solutions. 
If the functional requirements are presented in broad terms, then the solution space will be un- 
managably large. If specifications are introduced based on currently used components (i.e., 're¬ 
lieve pressure with zero seat leakage') then the solution space is artificially narrowed and the 
solutions which emerge will be biased towards the current component (in this case, a valve). 

Early in the design process these functional requirements can often only be presented broadly, 
and so the solution space must be artificially constrained by making reasonable assumptions based 
on engineering judgement and experience. As an example, consider the general functional re¬ 
quirement to 'prevent reverse flow' in an arbitrary flow stream. There is no specification of the 
fluid, fluid conditions (temperature, pressure, and flowrate), conditions when reverse flow must 
be prevented, or upstream and downstream components. However, reasonable assumptions can 
be made as to the conditions tmder which this requirement must be met to further specify the func¬ 
tional requirement and bound the solution space. In the main feedwater supply line, for example, 
this requirement can be further specified as 

• 'prevent reverse flow of high temperature and pressure water or water/steam mixture from 
the steam generator when the feedwater supply line pressure is less than steam generator 
pressure, 

• allow forward flow of low temperature, high pressure water with minimum resistance, and 

• perform functional requirement automatically and without an external energy input.' 

Our design paradigms lead us immediately to a swing-type check valve as a design solution to 
these requirements. However, these requirements could also be met by either of the arrangements 
shown in Figure 2-2. By not artificially over-constraining the design space, innovative solutions 
meeting the functional requirements can be generated. 
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Figure 2-2: Conceptual reverse flow preventers meeting functional requirements. Hydraulically 
operated gate valve (top) uses differential pressure between the main feedwater pump discharge 
and steam generator inlet to move the piston. The valve on the bottom uses a ball which is moved 
by form drag caused by the flowing fluid. For both cases, forward flow is from left to right. 

2.2.2 Regulatory Requirements 

The purpose of regulatory requirements is to ensure the health and safety of the general public. 
The scope and periodicity of any regulation should be traceable back to it's role in ensuring public 
health and safety. For any design decision made, the potential impact of that decision on public 
health and safety must be assessed so that the regulatory impact can be estimated. 

For the purposes of this thesis investigation, it is helpful to view regulatory requirements as 
being of two categories: those that currently exist and those that are likely to be generated as a 
result of design decisions which depart from current practice. It would be naive to assume that a 
creative design solution which satisfies the wording of a particular regulation will automatically 
satisfy the intent of the regulation. Most regulations are not developed proactively but rather 
reactively in response to a proposed design configuration or, in some cases, public perception of 
the risk associated with the proposed design. 

The Nuclear Regulatory Commission (NRC) has embarked on a wide range of efforts to in¬ 
crease the effectiveness with which it regulates the nuclear industry. Key to these improvements 
are three specific initiatives: the Regulatory Excellence initiative; the overall movement toward 
a regulatory approach that is risk-informed and, where appropriate, performance-based; and the 
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cost-beneficial licensing program.^ Strategies to make the entire NRC regulatory framework more 
risk-informed (i.e., such that areas of highest risk receive the greatest focus) and, where appro¬ 
priate, more performance-based (i.e., more results-oriented and more open to allowing licensee 
flexibility in how to meet NRC regulatory requirements) are being developed. 

The NRC staff has developed generic regulatory guidance, in the form of regulatory guides 
and standard review plans, as well as on the use of probabilistic risk assessment (PRA) findings 
and insights in support of licensee requests for changes to their licensing requirements. Pilot ap¬ 
plications have approved graded quality assurance requirements and increased allowed outage 
times for equipment in Technical Specifications.^ Out of these pilots, application-specific regula¬ 
tory guides and standard review plans are being developed and are under review by the Advisory 
Committee on Reactor Safeguards (ACRS). 

The NRC cost beneficial licensing action program was established in 1994 to increase agency 
responsiveness to licensee requests for reduction or elimination of license requirements with small 
effects on safety but high economic burden. Although activity and involvement in this volimtary 
program has varied among licensees, the NRC staff has approved over 300 cost beneficial licens¬ 
ing actions. The licensees estimate that the savings resulting from these cost beneficial licensing 
actions exceed $799 million over the life of the facilities. 

The cumulative effect of these NRC initiatives is to create a regulatory environment where the 
regulatory intent is being clarified and adherence to the intent of the regulations is being empha¬ 
sized. Rather than dictate to the licensee how to meet the regulatory requirements, the NRC is 
shifting the burden to the licensee to determine (and demonstrate) the most appropriate method 
of ensuring that the regulatory intent is met. This change creates design flexibility, since signif¬ 
icant departures from current design practice (such as is the case for IRIS) need only to demon¬ 
strate to the NRC what the safety role of the system/component is, the risk significance of the 
system/component, and what method(s) will be used to ensure that the system/component can 
perform the specified functions when required. 

’statement submitted by the United States Nuclear Regulatory Commission to the Subcommittee on Energy and 
Power, Committee on Commerce, United States House of Representatives by Shirley Ann Jackson, Chairman, USNRC, 
March 25,1998 

^Technical Specifications are part of an NRC license authorizing the operation of a nuclear production or utiliza¬ 
tion facility A Technical Specification establishes requirements for items such as safety limits, limiting safety system 
settings, limiting control settings, limiting conditions for operation, surveillance requirements, design features, and 
administrative controls. 
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2.2.3 Investment Protection Requirements 

Some components and systems such as the main turbine generator represent a significant 
capital investment by the owner/operator, and catastrosphic failure (and associated replacement 
costs) cannot be tolerated in a deregulated, economically competitive market. To ensure operabil¬ 
ity of these components the utility performs surveillances,^ even if not required by regulation. 
The scope and frequency of these surveillances are determined by trading off the risk (and cost) 
of failure and subsequent downtime against the cost of performing the surveillances. 

A subset of these investment protection requirements are surveillances performed to maintain 
the revenue stream. They typically are related to components that, if performance is degraded, 
directly impact the amoimt of electrical power generated. An example is the main condenser wa- 
terbox. Fouling of the condenser tubes by micro-organisms and other organic matter in the cooling 
water can significantly degrade the condenser heat transfer capability, reducing thermodynamic 
cycle efficiency. If the main condenser heat transfer capability is degraded, either the plant must 
be operated at reduced load or operate at full load and risk overheating and potentially severe 
damage to the condenser (including overpressurization and rupture). It is therefore in the eco¬ 
nomic interest of the utility to conduct periodic main condenser waterbox cleaning, and waterbox 
cleaning is currently performed at 18-24 month intervals (coincident with a refueling outage). 

2.2.4 Economical Solution 

An owner/operator operates for the sole purpose of generating revenue. It typically has no 
particular preference as to how the electricity is generated (coal, natural gas, or nuclear) as long 
as the plant meets environmental regulations and is economically competitive in the long-term 
market. As stated earlier, non-nuclear plants have significantly lower capital costs but nuclear 
plants incur significantly lower fuel costs. Therefore, to make a nuclear plant attractive to potential 
investors the capital costs must be reduced. 

All design decisions have an impact, either directly or indirectly, on both capital and operat¬ 
ing costs. However, potential investors are concerned about both the time to recoup the initial 
investment (which is directly linked to the capital costs) and the long-term profitability (which is 

^The term 'surveillance' defines a variety of component tests, inspections, overhauls, and preventive maintenance 
actions. 
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directly linked to the operating costs). Necessarily, then, these design decisions must consider the 
impact on both capital and operating costs together to find an optimal point. 

2.2.5 Operating Cycle Objectives 

To place the functional requirements in context, an operating (or maintenance) cycle length 
must be specified. To meet the specified cycle length objective, the component must either require 
no maintenance for the entire cycle or be maintainable during the cycle. From a practical stand¬ 
point, many components (or the systems in which they operate) can often be secured for short 
periods for the performance of maintenance. However, some components are necessary for con¬ 
tinuous plant operation or to ensure safety. These components cannot be secured unless their vital 
functions can be performed by another component or system. 

The operating cycle length goal for IRIS is eight years. It is not an objective to eliminate all 
maintenance between IRIS maintenance outages, but rather to perform all surveillances which 
have a periodicity of less than eight years on-line. However, to ensure proliferation resistance no 
operator access to the reactor island^ is permitted between refueling outages. 

As a strategy to achieve the eight year maintenance cycle length objective IRIS will first look 
to design solutions which permit on-line maintenance using current techniques and then, if a 
suitable design solution carmot be found, to development of techniques which will permit on-line 
maintenance of the current component. The benefit in seeking design solutions first is two-fold: 
the design will be to current standards and thus less susceptible to regulatory challenge, and 
the cost of development of new maintenance monitoring and performance evaluation techniques 
(including costs associated with potentially required regulatory changes) is avoided. 

2.2.6 Component Maintenance History 

In general, the further a design departs from current practice the greater the risk in terms of 
both cost and performance. It is prudent, therefore, to evaluate the component which is currently 
used to meet the specified functional requirements to assess it's deficiencies. A minimal risk solu¬ 
tion might be found which involves only a minor modification to the currently used component. 

‘^Specifically, no fuel access is permitted by preventing access to the reactor vessel internals during non-refueling 
outages. 
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A thorough evaluation of the currently used component may also discover component unde¬ 
sirable attributes which cannot be removed simply by minor component modification. Identifi¬ 
cation of these components, and the particular attributes requiring redesign, is a critical step in 
narrowing the number of components needing redesign to a managable size. In his 1996 thesis, 
Moore^ presented a strategy for a four year operating cycle at a commercial PWR plant. He con¬ 
cluded that to achieve a four year cycle at the plant being investigated significant modifications 
would be required, due in major part to a limited number of surveillances which could not be 
resolved to a four year operating cycle. 

2.2.7 Commercial Manufacturing Capability 

Implied in any design is the ability to manufacture the various components contained in the 
design. It is reasonable to assume that a currently manufactured component can be manufactured 
with minor modifications at roughly the same cost and on a similar manufacturing schedule. New 
components, on the other hand, require new machine tooling which adds significantly to the com¬ 
ponent acquisition cost and manufacturing timeline. Additionally, new components require test¬ 
ing and evaluation at much greater detail than modified components which also adds to the cost 
and procurement time. 

2.2.8 Emerging Technologies 

As owner/operators work toward a deregulated competitive marketplace, much effort has 
been expended examining the basis of current maintenance and operating practices. One area 
receiving considerable attention is reduction of outage duration by conducting maintenance on¬ 
line. The byproduct of this attention is research and development of advanced technologies which 
become on-line maintenance enablers. 

The focus in applying these technologies is on currently installed components, since extensive 
back-fits to install new components which utilize these new technologies are generally not cost 
effective. But, as a result of these development efforts, undeveloped technologies may exist which 

^Moore Jr., Thomas Joseph, "A Surveillance Strategy for a Four Year Operating Cycle in Commercial Pressurized 
Water Reactors/' Massachusetts Institute of Technology Department of Nuclear Engineering, Nuclear Engineer's The¬ 
sis, May 1996. 
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would be beneficial to a modified component but were not pursued further since they were not 
relevent to any currently installed components. 

2.2.9 Emerging Materials 

For certain component attributes which contribute to shortened life, such as corrosion resis¬ 
tance and susceptibility to embrittlement, new materials may provide solutions where the origi¬ 
nal component is retained but fabricated from a 'better' material. New materials may allow the 
component to operate in an environment that the original material could not, saving considerable 
design effort and simplifying the integration of the component into the overall design. New ma¬ 
terials, however, may not necessarily lead to cost savings since they may need to be proven in the 
anticipated operating environment. 

2.3 Methodology 

The simplified design resolution methodology is shown in Figure 2-3. The resolution method¬ 
ology iteratively evaluates the current state of the design against the specified requirements until 
all the requirements have been met through component modification or redesign. 

The resolution process begins with the fuctional requirement to be satisfied and the component 
currently used to satisfy that requirement. Successive iterations evaluate the design against the 
next performance requirement in an external process until all requirements have been satisfied. 
If the current state of the design does not meet a particular requirement, then the design is either 
modified (if possible) or a new design is generated (if necessary) by external processes.^ These 
external processes, described in detail in Chapter 5, draw upon the judgement and experience of 
the engineer to move past current design paradigms and apply creativity to overcome the imposed 
barrier. 

*Used in this thesis, external processes are those creative design processes which cannot be formally structured 
within the resolution methodology. 
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Figure 2-3: Simplified Design Resolution Methodology 







2.4 Output 

2.4.1 Evolutionary and Revolutionary Design Solutions 

When a limitation is identified in a component or system, or an increase in performance above 
current capabilities is required, design changes are required. The designer can either improve the 
current component by modifying the component {evolutionary design) or by finding a completely 
different method to meet the design requirements {revolutionary design). In practice, all design 
processes involve a combination of the two. The designer must always evaluate whether a revo¬ 
lutionary design would better accomplish the prescribed function than an evolutionary design in 
order to ensure that the most cost-effective and best engineered solution is obtained. 

Necessarily, IRIS will include both evolutionary and revolutionary design solutions. A truly 
revolutionary design is inherently unproven, and the economic risk is likely to be unacceptable. 
A truly evolutionary design is unlikely to significanly improve the performance (including main¬ 
tainability) of current PWR designs, and therefore may not be economically desirable. The implicit 
goal for IRIS, then, is to utilize revolutionary design solutions where necessary and evolutionary 
design solutions where practical. 

2.4.2 Design Alternatives 

The output from the methodology consists of a set of design alternatives, all of which meet the 
specified requirements, ranked by maintainability. The methodology will only be a useful tool for 
design optimization if the maintainability optimization has already been conducted. 
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Chapter 3 


Operating Pressurized Water Reactor 
Surveillance Program 

3.1 Introduction 

This chapter describes the cycle length barriers existing in a currently operating pressurized 
water reactor. The data utilized in this chapter is obtained from a recent thesis investigation into 
extending a candidate currently operating PWR from an 18 month to a 48 month operating cycle. 
The data has been reexamined, in the context of this thesis, to determine the types of maintenance 
related barriers for which a design solution must be found. 

After presenting the barriers to the candidate PWR 48 month operating cycle, the implications 
of the candidate PWR cycle length barriers on the IRIS cycle length are discussed. This chapter 
concludes by describing where design effort should be focused to resolve the cycle length barriers 
which will likely exist in an IRIS maintenance program. 

3.2 Basis for Operating Pressurized Water Reactor Surveillances 

Surveillances are performed either because they are required to ensure safety or because they 
are prudent to protect capital investment. All surveillances, then, can be categorized into the 
following two broad categories: 

• Regulatory Based: surveillances performed to meet technical specification requirements. In 
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general, the scope of the surveillance and the performance interval are specified by regula¬ 
tory authority. 

• Investment Protection : non-technical-specification-based surveillances, including surveil¬ 
lances performed as a result of committments to agencies other than the NRC. In general the 
scope, performance mode, and periodicity are selected at the discretion of the owner/operator 
to protect those systems and components with significant investment costs. 

The investment protection surveillances can be further broken down into the reactor and sup¬ 
porting components and systems, referred to as the nuclear steam supply system (NSSS), and all 
others, referred to as balance of plant (BOP). Since the safety function is primarily associated with 
the NSSS, most regulatory based surveillances apply to NSSS components and systems. 

3.3 A 48 Month Operating Pressurized Water Reactor Surveillance Pro¬ 
gram 

In 1996, Thomas Moore developed a surveillance strategy for a 48 month operating cycle in a 
commercial PWR.^ Moore's investigation was part of the Massachusetts Institute of Technology 
(MIT) Extended Fuel Cycle Project which, under the auspice of the MIT Program for Advanced 
Nuclear Power Studies, investigated surveillance strategies for extending commercial pressurized 
water and boiling water nuclear reactor plant operating cycles to 48 months.^ Moore analyzed the 
existing surveillance program at a candidate PWR plant to assess the impact of an operating cycle 
change from 18 months to 48 months. After appropriate justification, surveillances were placed 
in one of three categories: candidates for on-line performance (Category A); candidates for off¬ 
line performance interval extension to 48 months (Category B); and barriers to a 48 month cycle 
(Category C). 

The 3108 surveillances considered at the candidate PWR were categorized as following: 

'Moore Jr., Thomas Joseph, "A Surveillance Strategy for a Four Year Operating Cycle in Commercial Pressurized 
Water Reactors,” Massachusetts Institute of Technology Department of Nuclear Engineering, Nuclear Engineer's The¬ 
sis, May 1996. 

^McHenry, R.S., T.J. Moore, J.H. Maurer, and N.E. Todreas, "Surveillance Strategy for an Extended Operating Cycle 
i*' Commercial Nuclear Reactors," The Fifth International Topical Meeting on Nuclear Thermal Hydraulics, Operations, 
and Safety (NUTHOS-5), April 14-18,1997, Beijing, China. 
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• 2673 in Category A (on-line), of which 67 require a reduced power condition, 

• 381 in Category B (extended to 48 months), and 

• 54 in Category C (incompatible with a 48 month cycle). 

A breakdown of the candidate PWR surveillances is shown in Table 3.1.^ 

It should be noted that 690 electrical related investment protection surveillances were not ex¬ 
plicitly analyzed, but were considered conducive to on-line performance and are included in the 
Category A total. 

It should also be noted that many of the 381 Category B surveillances could have been placed in 
Category A rather than extending the surveillance periodicity. However, the goal of Moore's effort 
was to develop a balanced surveillance strategy and not simply to maximize on-line surveillance 
performance. For IRIS, maximizing the on-line surveillance performance will be a key enabler 
for the eight year operating cycle length objective. 

3.4 Extending the 48 Month Surveillance Program to Eight Years 

Although the MIT Extended Fuel Cycle Project team developed a four-year surveillance strat¬ 
egy, there has been no industry effort to achieve such an operating cycle length. A practical ap¬ 
plication of the proposed four-year surveillance strategy would have provided both validation of 
the methodology and historical data on the effectiveness of the methodology. In the absence of 
such data, resolving all surveillances at the operating PWR with respect to the baseline four year 
(or goal eight year) IRIS cycle length would require examination of each of the several thousand 
surveillances. It is not the intent of this thesis to resolve all the cycle length barriers, but rather to 
develop a methodology which will assist the reactor plant designer in designing systems which 
are not cycle length limiting. 

Therefore, this analysis will begin with the results of Moore's investigation into a 48 month op¬ 
erating cycle. Moore's investigation identified the barriers to extending the operating PWR from 
18 months to 48 months, and provided a methodology for developing the technical justification 

^Moore Jr., Thomas Joseph, "A Surveillance Strategy for a Four Year Operating Cycle in Commercial Pressurized 
Water Reactors," Massachusetts Institute of Technology Department of Nuclear Engineering, Nuclear Engineer's The¬ 
sis, May 1996, Tables 3-12 and 3-39. 
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Table 3.1: Recommended Pressurized Water Reactor 48 Month Operating Cycle Surveillance 
Program® 


Technical 


Surveillances 


Specification 


Cat A 

CatB 

Gate 

Regulatory Based Surveillances: 

In-Service Testing 

229 

147 

67 

15 

Reactivity Control 

17 

13 

4 

0 

Power Distribution Limits 

17 

17 

0 

0 

Instrumentation 

436 

390 

44 

2 

Reactor Coolant 

18 

13 

4 

1 

Emergency Core Cooling System 

16 

9 

5 

2 

Containment 

81 

61 

20 

0 

Plant Systems 

51 

51 

0 

0 

Electrical Systems 

846 

824 

22 

0 

Technical Requirements 

61 

61 

0 

0 

Subtotal 

1772 

1586 

571 

20 

NSSS“ Investment Protection Surveillances: 

Component Cooling 

21 

8 

4 

9 

Rod Control 

22 

6 

16 

0 

Chemical Volume and Control 

7 

3 

3 

1 

Nuclear Instruments 

4 

0 

4 

0 

Reactor Coolant 

84 

39 

37 

8 

Residual Heat Removal/Safety Injection 

4 

0 

4 

0 

Miscellaneous NSSS 

84 

44 

40 

0 

Subtotal 

226 

100 

108 

18 

BOP^ Investment Protection Surveillances: 

Auxiliary Systems 

83 

35 

41 

7 

Condensate 

17 

14 

0 

3 

Circulating Water/Service Water 

19 

14 

5 

0 

Diesel Generator 

28 

26 

2 

0 

Main Steam 

39 

21 

12 

6 

Feedwater 

60 

45 

15 

0 

Turbine Systems 

72 

49 

23 

0 

Miscellaneous BOP 

102 

93 

9 

0 

Subtotal 

420 

297 

W 

16 

'■Total 

31Q8T 

2673‘='i 

381 

54'?^ 


‘^Nuclear Steam Supply System 
^Balance of Plant 

‘^Includes 690 electrical systems investment protection surveillances which, although not analyzed, are considered 
likely candidates for on-line performance 
^^67 at reduced power 




for performance interval extension. After application of the methodology, 54 off-line surveillances 
were identified that would not be compatible with a 48 month operating cycle. An additional 
381 off-line surveillances were either already compatible with the 48 month operating cycle or 
could have their performance interval extended, based on the performance interval extension 
methodology, to 48 months. 

Because of his objectives, Moore's investigation did not consider either shutdown surveil¬ 
lances^ or off-line surveillances^ with a performance interval already compatible with a 48 month 
operating cycle. There are shutdown surveillances which cannot have their performance interval 
extended to eight years even though they are only required to be performed during an outage. 
An example is shutdown rod testing, which is required each outage in which reactor vessel head 
removal occurs. Although no performance interval is specified, it is unlikely that an eight year 
rod testing performance interval (i.e., the IRIS refueling interval) will be frequent enough to val¬ 
idate the reactor protection system assumptions regarding rod control system performance (e.g., 
position indication, rod speed, and rod motion without binding). Of greater potential impact are 
the off-line surveillances which were already compatible with a 48 month operating cycle (and 
neither identified nor investigated by Moore), but are unlikely to be compatible with an eight year 
operating cycle. 

Assessment of the operating PWR surveillance program relative to the IRIS eight-year operat¬ 
ing cycle length objective requires, in part, resolution of the 435 surveillances (54 Category C and 
381 Category B) identified by Moore. It must be recognized that the technical justification Moore 
provided to extend the Category B surveillances to 48 months may not necessarily apply to an in¬ 
terval extension to eight years, resulting in IRIS cycle length barriers.^ However, development of 
a methodology which will resolve the identified Category C barriers will likely provide a solution 
to the unidentified Category B barriers as well. 

^Shutdown surveillances are those surveillances which are performed in conjunction with a planned outage, usually 
on components and systems which support the outage. These surveillances are not required to be performed when the 
reactor plant is at power. 

^Off-line surveillances are surveillances on components and systems which support power operation, but cannot be 
performed at power. 

^As stated in Section 1.3, the IRIS operating cycle objective is eight years. The BNFL economic model indicates that 
IRIS is still economically competitive with a maintenance outage at mid-cycle, but an eight-year maintenance cycle is 
preferred. The economic model also indicates that with more than one maintenance outage per eight-year refueling 
cycle, IRIS economic competitiveness drops considerably. 



3.5 Potential IRIS Cycle Length Barriers 


The following discussion describes the operating PWR Class C maintenance-related barriers 
which are potential barriers to the eight-year IRIS operating cycle length. This section only identi¬ 
fies the limitations of current PWRs if the operating cycle were extended to eight years, regardless 
of whether or not those components and systems would be utilized in IRIS. Although Table 3.1 
breaks down the surveillances by system, the discussion here will focus on the general limita¬ 
tions by component type. As noted in Section 3.4 above, some Category B surveillances could 
also be limiting for an operating cycle length greater than 48 months. However, the Category C 
surveillances are representative of the maintenance-related barriers existing in the operating PWR 
surveillance program and a methodology to resolve the Category C surveillances should also lead 
to resolution of the Category B surveillances as well. 

3.5.1 Regulatory Based Surveillances 

Regulatory based surveillances are those surveillances performed to meet technical specifica¬ 
tion requirements. Administrative Technical Specifications and Refueling Technical Specifications 
were not included in the original analysis, and are not included here, since their specific require¬ 
ments are independent of cycle length. 

3.5.1.1 Relief Valves 

At the candidate PWR, there are several regulatory based relief valve surveillances which 
are currently performed shutdown. The relief valves to which these surveillances apply can¬ 
not be tested on-line and, because of their performance history, testing cannot be extended to 
eight years. At the candidate PWR these 38 valves include the three American Society of Me¬ 
chanical Engineers (ASME) Class 1 pressurizer relief valves and 35 ASME Class 2 containment 
pressure boundary relief valves.^ Extrapolating the candidate PWR's valve performance history, 
and based on consistent but limited survey results, it appears likely that no relief valve used in 

^Generally, ASME Code Class 1 includes all reactor pressure boundary components. ASME Code Class 2 gener¬ 
ally includes systems or portions of systems important to safety that are designed for post-accident containment and 
removal of heat and fission products. ASME Code Class 3 generally includes those system components or portions 
of systems important to safety that are designed to provide cooling water and auxiliary feedwater for the front-line 
systems. 
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these applications (regardless of specific type or brand) has a performance history which supports 
an eight year testing interval. 

The Operations and Maintenance of Nuclear Power Plants, ASME/ANSI, OM-1989,® Chap¬ 
ter 1, lists the requirements for in-service performance testing of nuclear power plant pressure 
relief devices. It requires all ASME Class 1 relief valves to be tested every five years and that 
at least 25% of each type of Class 1 valve be tested every 24 months, 50% every 36 months, 75% 
every 48 months, and every relief valve be tested at least once every 60 months. Plants have the 
option of testing the relief valves in place or replacing the relief valve with a bench tested spare. 
Relief valves which are replaced by bench tested spares are also required to be bench tested after 
removal to determine if a removed valve exceeds the ±3% set pressure criteria. For those relief 
valves failing to meet set pressure criteria, the causal effect must be evaluated to determine the 
need for additional testing. The candidate PWR conducts Class 1 relief valve testing at a shorter 
interval, coincident with refueling outages. 

The Class 2 relief valves can also either be tested in place or replaced by a bench tested spare. 
Unlike Class 1 relief valves. Class 2 relief valves are only required to be tested every ten years 
with at least 25% of each type tested every 48 months. However, the performance of the candidate 
PWR's Class 2 relief valves has not proven historically to be good enough to suggest that testing 
at an eight year interval would be acceptable. 

From the above discussion, it appears imlikley that any Class 1 or Class 2 relief valve can 
operate for an entire eight year maintenance cycle without testing. Therefore, to eliminate the 
need for frequent shutdowns a method to either remove or test these relief valves on-line must be 
developed. 

3.5.1.2 Motor Operated Valves 

The candidate PWR has surveillances involving motor operated valves (MOVs) which can¬ 
not be performed on-line and, based on industry experience with motor operated valve (MOV) 
performance and subsequent regulatory response, are unlikely to have their performance inter¬ 
val extended. Nuclear power plant operating experience, valve performance problems and MOV 

I 

^Subsequent updates to "The Operations and Maintenance of Nuclear Power Plants," have occured but the 1989 
Edition of Section XI is referenced in 10 CFR §50.55a(b). 



research have revealed that the focus of the ASME Code on stroke time and leak-rate testing for 
MOVs was not sufficient in light of the design of the valves and the conditions under which 
they must function. For this reason, on June 28, 1989, the NRC staff issued Generic Letter (GL) 
89-10, "Safety-Related Motor-Operated Valve Testing and Surveillance." In GL 89-10, the staff re¬ 
quested that licensees and permit holders ensure the capability of MOVs in safety-related systems 
to perform their intended functions by reviewing MOV design bases, verifying MOV switch set¬ 
tings initially and periodically,^ testing MOVs under design-basis conditions where practicable, 
improving evaluations of MOV failures and necessary corrective action, and trending MOV prob¬ 
lems. Generic Letter 89-10 was superceded by GL 96-05, "Periodic Verification of Design-Basis 
Capability of Safety-Related Motor-Operated Valves," issued September 18,1996. 

The code states that the maximum inservice test frequency shall not exceed ten years. In GL 
96-05, the NRC staff agrees with this condition of a maximum test interval of ten years based 
on current knowledge and experience. However, in addition to this maximum test interval, in the 
case where a selected test interval extends beyond five years or three refueling outages (whichever 
is longer), GL 96-05 states that the licensee should evaluate information obtained from valve 
testing conducted during the first five-year or three-refueling-outage time period to validate as¬ 
sumptions made in justifying the longer test interval. Based on performance and test experience 
obtained during the initial interval, a licensee may be able to justify lengthened MOV periodic 
verification intervals. 

As discussed in GL 96-05, the NRC staff has long recognized the limitations of using stroke¬ 
time testing as a means of monitoring the operational readiness of MOVs and has supported in¬ 
dustry efforts to improve MOV periodic monitoring under the in-service testing (1ST) program 
and GL 89-10. As such, the staff would consider a periodic verification program that provides an 
acceptable level of quality and safety as an alternative to the current 1ST requirements for stroke¬ 
time testing and could authorize such an alternative, upon application by a licensee, pursuant to 
the provisions of 10CFR50.55a(a)(3)(i). 

Licensees of several facilities (for example, Callaway, Monticello, and South Texas) have estab- 

®No specific periodicity is established by the NRC. However, in GL 89-10 the NRC suggested that the MOV data 
be periodically examined (at least every 2 years or after each refueling outage after program implementation) as part 
of a monitoring and feedback effort to establish trends of MOV operability. These trends, according to the NRC, could 
provide the basis for a licensee revision of the testing frequency established to periodically verify the adequacy of MOV 
switch settings. 



lished MOV periodic verification programs that the staff found acceptable during closure of its 
review of GL 89-10 programs. One approach to MOV periodic verification that the staff found 
acceptable is to diagnostically test each safety-related MOV every five years (or every three refuel¬ 
ing outages) to determine thrust and torque motor-actuator output and any changes in the output. 
A specific margin to account for potential degradation such as that caused by age (in addition to 
margin for diagnostic error, equipment repeatability, load-sensitive behavior, and lubricant degra¬ 
dation) is established above the minimum thrust and torque requirements determined under the 
GL 89-10 program. The selection of MOVs for testing and their test conditions should take into 
accoxmt safety significance, available margin, MOV environment, and the benefits and potential 
adverse effects of static and dynamic periodic verification testing on the selected MOV sample. 
Measures such as grouping and sharing of valve performance between facilities are appropriate 
to minimize the need to conduct more rigorous periodic verification tests. 

Two significant conclusions can be drawn from the above discussion. First, a periodic veri¬ 
fication program that actually strokes the MOV is the minimum acceptable requirement to ver¬ 
ify operability. Second, the longest periodicity deemed acceptable by the NRG is five years and 
this periodicity is based on utilization of historical performance of the actual MOVS for trending. 
Therefore, it is unlikely that the testing periodicity of a new MOV can be established at eight years 
until sufficient performance data can be collected in accordance with GL 89-10. The implication 
of these conclusions is that, for an operating cycle length greater than five years, an acceptable 
on-line MOV testing method which actually strokes the valve must be developed. 

3.5.1.3 Other In-Service Testing 

The ASME Boiler and Pressure Vessel Code, Section XI, "Rules for In-Service Inspection of 
Nuclear Power Plant Components," requires that all safety related pumps and valves be tested 
for operability on a quarterly basis. In some instances, performance of the required testing is 
either hazardous or impossible to perform on-line. The owner/operator may petition the NRG to 
defer the surveillance, using a risk-based argument. However, deferral has only been previously 
granted for Refueling and Cold Shutdown surveillances. Refueling surveillances are those which 
caimot practically be performed with the reactor core installed. Cold Shutdown surveillances are 
not as limiting as Refueling surveillances, but still carmot be performed with the plant on-line. 
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In both cases, the surveillances involve only standby systems such as the Residual Heat Removal 
System and the Safety Injection System. 

If a plant incurs an implanned outage during the operating cycle after more than three months 
from the last in-service testing period, the ASME code requires the following rules be followed 
for all surveillances designated as Cold Shutdown Tests: 

• Testing is to commence as soon as practical when the Cold Shutdown condition is achieved, 
but no later than 48 hours after shutdown. Testing shall continue vmtil all testing is com¬ 
pleted or the plant is ready to return to power. 

• Completion of all testing is not a prerequisite to return to power, and any testing not com¬ 
pleted during one cold shutdown should be performed during any subsequent cold shut¬ 
down starting with those tests not previously completed. 

• Testing need not be performed more often than once every 3 months. 

• In the case of an extended cold shutdown, the testing need not be started within 48 hours, 
but all Cold Shutdown Testing must be completed prior to returning to power. 

If a plant operates uninterrupted for an entire cycle, cold shutdown testing is only performed 
diuing refueling outages. The ASME code does not address an upper limit on the allowable 
length between Cold Shutdown Testing. Technical justification would be necessary to extend the 
permissible interval to eight years, to be consistent with the IRIS cycle length. 

3.5.1.4 Engineered Safety Features 

The candidate PWR has regulatory based surveillances involving three similar Engineered 
Safety Feature Actuation System tests which cannot be performed on-line and which are unlikely 
to be extendable to eight years. These are integrated tests which involve sensors, signal processing, 
and valve and pump actuation. The tests are: 

• Diesel Generator Operability and Engineered Safeguards Pump and Valve Response Time 
Testing. It would be possible to devise a testing procedure which would test the integrated 
features of all the safety systems involved, with the exception of actually injecting water 
into the core. But since (cold) water injection to a critical reactor would risk an unacceptable 





power excursion, there are no testing scenarios which would allow this test to be performed 
safely at power. This test is central to proving that cooling water can be delivered to the 
core in sufficient quantities to mitigate postulated accidents, so the proof-of-flow portion is 
unlikely to be deferrable. 

• Actuation of Auto Safety Injection, Containment Building Spray, and Control Building Air 
Systems. This surveillance verifies system actuation (and appropriate alarms) within allow¬ 
able time limits upon receipt of a command signal. Because response time includes the time 
for the components to physically actuate (i.e., valves open and switches close), acceptable 
performance is unlikely to be demonstrated using signal monitoring only. 

• Emergency Core Cooling Systems Automatic Actuation Test. This surveillance tests that 
the various Emergency Core Cooling System components will realign within specified time 
limits upon receipt of a Safety Injection signal including the initiation of feedwater isolation, 
diesel generator start, containment isolation, containment ventilation systems isolation, and 
primary component cooling water system realignment. This test carmot be conducted on¬ 
line due to feedwater isolation, and because of it's accident mitigation function is unlikely 
to be deferrable. 

These surveillances are performed to ensure that necessary safety systems are operable and 
will perform when required. Based on their safety importance, they cannot be deferred eight years 
to the refueling outage. Therefore, a method to verify the operability of these systems on-line must 
be developed. Particularly challenging will be development of a safe, yet thorough and effective, 
method to conduct on-line testing of those components which involve physical operations that 
present a safety risk (such as valve actuation which would permit cold water injection to a critical 
reactor). 

3.5.1.5 Steam Generator Eddy Current Testing 

Current NRC inspection guidelines for steam generators require eddy current testing of the 
steam generator tube bundle at a periodicity of up to 40 months. After conducting an eddy current 
inspection, the allowed operating period until the next required inspection is established by the 
owner/operator after analysis of all previous inspection results. The 40 month periodicity can be 
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utilized only after two previous successful inspections at shorter intervals indicate no tube degre- 
dation has occured which can potentially lead to tube failure. Although there are development 
efforts imderway, there currently exists no method for on-line steam generator tube inspection. 
Based on previous experience within the nuclear industry with tube failures due to stress corro¬ 
sion cracking and aging, steam generator eddy current testing is unlikely to be deferrable. 

As a preliminary step in evaluating a transition to a 48 month fuel cycle, the candidate PWR 
completed a draft technical request to the NRC to extend the interval between steam generator 
tube inspections to 50 months. The technical evaluation concluded that tube degredation over 
the course of 50 months in the type^® of steam generators used at the candidate PWR would 
not reduce the margins of safety required by NRC Regulatory Guide 1.121, "Bases for Plugging 
Degraded PWR Steam Generator Tubes," August, 1976. No decision was made on this request, 
however, since the candidate PWR opted to pursue (for a variety of other reasons) a 24 month 
operating cycle as an intermediate step to an extended operating cycle. 

Steam generator tubing makes up a significant portion of the reactor coolant pressure boimd- 
ary (RCPB), and the industry-wide historical performance dictates that inspections be conducted 
to verify the integrity of this boundry. The inspection frequency has been established by consider¬ 
ation of this performance, and it is unlikely that it will be feasible to extend this frequency to eight 
years. Therefore, an on-line inspection method (and the means to conduct it) must be developed. 

3.5.1.6 Rod Drop and Rod Position Indication Testing 

Control and shutdown rod drop testing is currently performed at the candidate PWR follow¬ 
ing refueling to guarantee that the control rods have an unimpeded path to the bottom of the core 
and that maximiun drop times are consistent with the assumed drop times used in the plant safety 
analysis. 

The NRC Improved Standard Technical Specifications only require rod drop testing following 
vessel head removal, and no upper limit to the periodicity is currently specified. However, a 
senior NRC inspector indicated during an informal discussion that the decision not to place an 
upper limit on the periodicity was, in part, due to the fact that no current plant operates on a cycle 

’“The candidate PWR uses four Westinghouse Model F steam generators with 5626 Thermally Treated, Inconel 600 
U-tubes (SB-163) hydraulically expanded into the tubesheet at each end. The tube bundle is supported by "V''-shaped 
Anti-Vibration Bars in the U-tube bend region and eight stainless steel tube support plates. 
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length where fuel swelling would be a significant concem.^^ Since IRIS will operate on a cycle 
that is more than twice the length of the longest current operating cycle, it is likely that an upper 
limit will be placed on rod drop testing periodicity and that it will be less than eight years. 

Rod position indication testing is normally conducted in conjxmction with rod drop testing, 
and is required every 18 months. For the candidate PWR, once at power the control and shut¬ 
down rods are fully withdrawn and remain fully withdrawn with long term reactivity control 
maintained by primary coolant boron inventory. Since the relationship between actual and in¬ 
dicated position does not change during the cycle (as long as the rods remain fully withdrawn), 
these checks can be deferred (if necessary) past 18 months to the scheduled shutdown period. 

If control rod motion is used for long term reactivity control, instead of using boron inventory, 
then the assumption that the relationship between actual and indicated position does not change 
during the cycle is no longer valid. Under these conditions, it is unlikely that the rod position 
indication checks would be deferrable eight years to the scheduled shutdown period. 

3.5.1.7 Reactor Coolant Pumps 

Inspection of the reactor coolant pump flywheel bore and keyway are ultrasonically inspected 
for volumetric expansion in the areas of highest stress concentration every 36 months. Addition¬ 
ally, a complete surface examination of all exposed reactor coolant pump surfaces and a complete 
ultrasonic volumetric examination is conducted at ten year intervals. All of these inspections re¬ 
quire the reactor coolant pumps to be secured. 

3.5.1.8 Electrical Breaker Checks 

There are several safety equipment breaker overcurrent relay checks which are currently per¬ 
formed at 36 month intervals but, due to their importance in safety assurance, are unlikely to be 
deferrable to eight years. 

In a typical three zone refueling scheme for a plant with a 24 month operating cycle, a batch would remain in the 
core for 72 months. However, demonstration that the controls rods have an unimpeded path to the bottom of the core 
is performed every 24 months. 



3.5.2 Investment Protection Surveillances 


Investment protection surveillances include all the non-technical-spedfication-based surveil¬ 
lances performed at the candidate PWR. A small number of these are performed as a result of 
commitments to agencies other than the NRC. In general, however, the investment protection 
surveillences are performed in the mode and at the interval selected by the utility to protect those 
systems and components with significant investment costs. 

For this investigation, a large number of the Category B investment protection surveillances 
have been summarily dismissed from consideration as maintenance-related barriers to the eight 
year operating cycle. These siuveillances involve components which can either be easily removed 
from the design (or replaced by a less maintenance intensive component) or for which an on¬ 
line method of performance could readily be developed. An example is installing an instrument 
bypass in the Reactor Trip System. This allows on-line testing of a single protection channel 
without the test signal being interpreted by the protective system as a genuine trip signal, and 
reduces the probability of receiving a spurious protective action. 

3.5.2.1 Relief Valves 

At the candidate PWR there are several relief valve investment protection surveillances which 
cannot be performed on-line and, based on component operating history, the testing interval can¬ 
not be extended. The relief valves are Class 2 containment boundary valves, of the same design as 
the regulatory based relief valves, and the same discussion applies. 

3.5.2.2 Condenser Waterbox 

The main condenser is the primary heat sink for the power plant. If the main condenser heat 
transfer capability is degraded, then the plant must either operate at reduced power or risk con¬ 
denser damage due to overheating and overpressurization. The candidate PWR performs con¬ 
denser waterbox cleaning every 18 months, during which all steam must be secured since the 
three tube bundles are not individually isolable. Based on material history, this interval cannot be 
extended. 
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3.5.2.3 Reactor Coolant Pumps 

There are eight reactor coolant pump surveillances, all involving the reactor coolant pump 
lubrication oil system, which require the pumps to be secured and (based on material history) 
cannot be performed at a longer interval. These surveillances include checking the pump oil hi/lo 
level alarms, lube oil sampling, and lube oil change. 

3.5.2.4 Main Turbine 

The main turbine and generator represent a substantial capital investment, and the large num¬ 
ber of surveillances on this machine reflect the magnitude of this investment. In general the main 
turbine system surveillances involve the speed govemer, lubricating oil system, and generator 
electrical components. The generator surveillances are all performed at 72-96 month intervals, 
and in general surveillance results at the operating PWR have been satisfactory suggesting that 
all these surveillances could be extended to eight years. However, the main turbine speed gov¬ 
emer and lubricating oil system surveillances are unlikely to be extended past 48 months. 

3.5.2.5 Main Steam 

There are several surveillances on the main steam isolation valves involving component re¬ 
placement (software and solenoids) which could physically be performed on-line, but are neces¬ 
sarily performed off-line since isolation valve operation is prevented during performance of the 
surveillances. The main steam relief valves require periodic lift testing and, like all other relief 
valves, are unisolable from the system and thus must be tested off-line. 

3.6 Summary 

This chapter presented the maintenance related operating cycle length barriers existing in the 
surveillance program of a currently operating PWR. A tabular summary of these barriers in pre¬ 
sented in Appendix A. After review of the off-line portion of the operating PWR surveillance 
program, 54 surveillances are identified as definite barriers and another 381 have been identified 
as potential barriers. Of these barriers, some will be eliminated by design differences between the 
operating PWR and IRIS while the rest will need to be eliminated be design. 



It is not the intent of this thesis to resolve all the cycle length barriers. However, this evaluation 
of the maintenance related operating cycle length barriers provides the foundation to develop a 
methodology which will assist the reactor plant designer in designing systems which are not cycle 
length limiting. To achieve the IRIS operating cycle length goal, all surveillances must either 
be conducted with the plant at power or have a maintenance periodicity at least as long as the 
refueling outage interval. 



Chapter 4 


Surveillance Resolution Strategy 

4.1 Introduction 

This chapter outlines the strategy used to resolve the maintenance-related barriers identified in 
the candidate PWR surveillance program. First, the surveillances are categorized to identify how 
they will be addressed relative to IRIS. Next, the methods which may lead to on-line performance 
or complete elimination of these surveillances are presented. After evaluating the surveillances for 
on-line performance or elimination, those surveillances which remain are those requiring design 
resolution. 

4.2 Surveillance Categorization Relative to IRIS 

With respect to IRIS, the operating PWR surveillances can be placed into one of four categories: 

Category 1; On-line surveillances which will be performed on-line in IRIS; 

Category 2: Candidate surveillances for design resolution to create an on-line performance 
mode in IRIS; 

Category 3: Surveillances requiring further analysis to determine performance mode in IRIS; 
and. 

Category 4: Off-line surveillances likely to have performance interval extended to at least 
eight years in IRIS. 



The flowchart in Figure 4-1 shows how the operating PWR surveillances (Categories A, B, and C) 
are segregated into these four numerical categories. This thesis will focus on those surveillances 
requiring design resolution. Category 2. Beginning with all surveillances performed at the oper¬ 
ating PWR, it can reasonably be expected that an on-line performance mode in IRIS can be found 
for those operating PWR surveillances currently performed on-line. It can also be expected that, 
although likely few in number, there exists surveillances that are likely to have their performance 
intervals extended to at least eight years. After removing these two groups, the operating PWR 
off-line and shutdown surveillances remain. These can be immediately segregated into those per¬ 
formed off-line at less than 48 month intervals (i.e., those analyzed by Moore) and those with a 
performance interval greater than 48 months or performed shutdown. 

Although they are expected to be characterized by the Category 2 surveillances, those surveil¬ 
lances with a performance interval greater than 48 months or performed shutdown were not 
specifically analyzed by Moore and will not be analyzed here. These surveillances are imme¬ 
diately carried down to the 'further analysis' category. Of those surveillances performed off-line 
at less than 48 month intervals, many have an on-line performance mode and are thus placed in 
the 'IRIS online' category. The remaining 435 operating PWR surveillances (54 Category C plus 
381 Category B) which are currently performed off-line and do not have an on-line performance 
mode are the potential IRIS cycle length barriers. 

From this group of 435 surveillances a qualitative assesment will be made as to whether the 
surveillance plausibly could have an on-line performance mode in IRIS, based on the IRIS design 
goals and objectives. Included in this category are surveillances which are not required in IRIS 
based on expected configuration differences between the operating PWR and IRIS. However, as 
seen in Figure 4-1, these surveillances are carried into the 'further analysis' category since any 
change in the IRIS design goals and objectives may make them applicable. Those surveillances for 
which an on-line mode is not plausible are carried down to the 'design resolution' category. 

The last category includes those surveillances which plausibly could have their performance 
interval extended to eight years. A separate category was created for these surveillances, but it is 
anticipated that they will be few in number. 
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4.3 Resolution Categorization Considerations 

The remainder of this chapter describes in greater detail the considerations given when catego¬ 
rizing the operating PWR surveillances according to Figure 4-1. Although imable to be captured 
here, engineering judgement and experience are critical to proper evaluation and categorization 
of the surveillances. Costly design mistakes can often be avoided by having an seasoned designer 
compare the design team's evaluation against previous design efforts. 

4.3.1 Plausibly On-Line or Eliminated Surveillances 

All investment protection surveillances can be considered for elimination or performance in¬ 
terval extension, since their performance mode and interval are generally not established by reg¬ 
ulatory authority. However, since the intent of these surveillances is to protect a large capital 
investment, categorically eliminating these surveillances is neither prudent nor responsible. Anal¬ 
ysis must consider the cost of performing the surveillance (including planned outage downtime 
costs) against the cost of unexpected failure (include forced outage costs) if the surveillance is not 
performed. However, this investigation is based on the premise that the IRIS cycle length ob¬ 
jective is a key factor in making IRIS desirable to a potential customer and thus economics will 
only be considered on a qualitative basis, and only when the cost impact of a particular decision 
is significant. 

Regulatory surveillances, on the other hand, are unlikely to be eliminated since their basis is 
ensuring protection of the public. It is possible, however, that an acceptable alternative surveil¬ 
lance can be created which provides the same safety assurance. The NRC has indicated a will¬ 
ingness to consider alternatives as long as the proposed method demonstrates operability and is 
adequately supported by technical justification. For example, the NRC acknowledges the limi¬ 
tations of stroke-time testing of MO Vs in assessing operational readiness. It has stated it would 
consider authorizing a testing program which provides an acceptable level of quality and safety 
in lieu of stroke-time testing to meet 1ST requirements.^ 

Because of their importance in demonstrating the ability to perform safety functions, regu¬ 
latory based surveillances are imlikely to have their periodicity extended to be compatible with 
’NRC Generic Letter 89-10 
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the IRIS operating cycle length until sufficient historical data is collected (at testing intervals less 
than eight years) to provide technical justification for extension. Therefore, unless the first several 
IRIS operating cycles are of the same length as currently operating PWR cycles (to collect in-situ 
historical data) these surveillances must either be performed on-line or eliminated by design. To 
provide for an on-line performance mode, the applicable system or component must either be able 
to be temporarily taken out of service for testing without compromising operational safety or be 
able to be tested without interrupting the operability of the component. 

To eliminate a surveillance the function performed by the component or system must be per¬ 
formed by a different set of components for which the surveillance is not applicable, or the func¬ 
tional requirement must be eliminated completely. Although this objective is similar to the ob¬ 
jective of the 'design resolution' category, these eliminated surveillances are those for which a 
readily apparent solution is available. Based on IRIS design objectives and goals, there will be no 
chemical and volume control system and therefore all operating PWR surveillances on this sys¬ 
tem are eliminated in IRIS. Note, however, that these surveillances are carried into Category 2 
(design resolution) since elimination is the design resolution made at a particular stage in the de¬ 
sign. If the design changes to include a chemical and volume control system, then the applicable 
surveillances must be resolved again in terms of the current design objectives and goals. 

4.3.1.1 Advanced Monitoring Techniques 

Advances in remote and on-line monitoring techniques now allow for conducting many in¬ 
spections at power in locations which are, due either to environment or radiation, unaccessible 
by personnel. Examples of these techniques include robot assisted ultrasonic inspection, on-line 
motion and vibration monitoring, and radiation hardened infrared imaging. A common charac¬ 
teristic of all these techniques is that they are passive, non-destructive, and non-invasive. 

Selection of representative indications which can be monitored by these advanced techmques 
to adequately characterize the condition of the component can produce a two-fold benefit. First, 
the investment is better protected by more frequent (or even continuous) assessment of component 
condition without requiring an outage. Second, these techniques are generally passive and no 
testing-induced failures (which can occur with a time-based surveillance program) are expected. 

For microprocessor controlled components and systems, integral diagnostics can be included 



in the control logic which routes short duration (i.e., too short to cause component or system 
response) signals throughout the entire circuit to verify electronic continuity. Although this does 
not demonstrate component response to the applied signal, it does minimize the amoimt of the 
system for which assured operation is uncertain. 

4.3.1.2 Improved Technologies 

Many commercial industries have, over the past several decades, taken a critical look at their 
maintenance practices in a focused effort to reduce operating and maintenance costs. As a re¬ 
sult, a new generation of highly reliable and more easily maintained components have emerged 
from vendors and manufacturers. In most cases the capital expenditure to backfit a operating 
PWR with these new components is not justified by the reduced maintenance return, since the 
operating PWR operating cycle length is currently short enough to perform effective (although 
frequent) maintenance on the older components. New design and construction, however, affords 
the opportunity to take advantage of these component improvements. 

Switchboard and breaker technology, for example, has improved significantly. Fully-enclosed 
switchboards are now available which do not require frequent cleaning. These enclosed switch¬ 
boards can also be fitted with infrared sensors and fire extinguishing agents to minimize the im¬ 
pact of electrical-related fires. The air circuit breaker will soon give way to the solid-state breaker, 
based on power electronics building block (PEBB) technology (Figure 4-2). Solid-state breakers 
under development contain the integral diagnostics discussed above which can verify the oper¬ 
ability of breaker protective features without interrupting power to the load.^ Solid-state breakers 
based on PEBB technology can also be used in an electrically-reconfigurable electric power dis¬ 
tribution system, allowing for multiple power sources for a vital component without the need 
for relays or bus transfer switches.^ Application of these technologies will eliminate the need to 
secure a load in order to inspect and verify proper operation of the load's power supply. 

^U.S. Navy Office of Naval Research, http://pebb.onr.navy.mil. 

Borraccini, J., W. Ruby, T. Duong, D. Cochran, E. Roth, D. McLaughlin, and T. Ericsen, ^^Demonstration of Power 
Electronic Building Block (PEBBl) Function and Plans for PEBB2 and PEBB3,” Government Microcircuit Applications 
Conference (GOMAC), Las Vegas, March, 1997. 
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Figure 4-2: Power Electronics Building Block Functional Diagram 

4.3.1.3 Redundant Capabilities 

Many investment protection calibrations and alignments can have their periodicity extended 
by installation of diverse, reliable, and redimdant monitoring capability. Methods selected should 
operate different enough (with different calibration curve slopes and failure indications) so that 
the instruments cannot drift the same way and provide a consistent inaccurate indication. This 
will ensure that consistent indication correlation between these redundant monitoring methods 
is accurate and reliable, eliminating the need for instrument calibrations and alignments until a 
divergence of these redundant monitoring methods is indicated. 

4.3.1.4 Regulatory Change 

As noted previously, the NRC has indicated a willingness to consider alternatives to current 
testing requirements as long as adequate technical justification is provided. However, since this 
technical justification is based on the performance of a particular component in a particular ap¬ 
plication, it is unlikely that a significant number of regulatory changes would be approved for 
simultaneous application in a new reactor plant design where no performance history exists. 













4.3.2 Surveillances Requiring Design Resolution 


After evaluating the off-line surveillances for a plausible on-line solution (or elimination), the 
remaining surveillances are those which prevent attaining the IRIS cycle length objective. Al¬ 
though this category is populated by discrete components, the aggregate set represents the general 
challenges to IRIS for which a systematic methodology for resolution must be found. 

Where design is necessary to create an on-line performance mode, the preferred order of design 
is: 


1) utilize existing components, 

2) utilize existing technologies, 

3) develop new components/systems, and 

4) develop new technologies. 

In order, each method involves increasing design effort and risk. 

The reader is reminded that the objective of this thesis is not to resolve all 435 surveillances 
identified above, but rather to categorize the barriers in more general terms such as classes of 
components which share common limitations. It is from these generalizations that the resolution 
methodology will be developed, so that design resolution of particular IRIS maintenance-related 
barriers can be made. 

4.4 Summary 

This chapter has outlined the methods available to the designer which can be used to resolve 
identified operating cycle length barriers. The strategy for eliminating these barriers is "defer if 
practical, perform on-line when possible, and eliminate by design where necessary." Evaluating 
surveillances for deferral requires in-depth analysis of the surveillance basis and the component's 
maintenance history. This evaluation is outside the objectives of this thesis, but is necessary in any 
reactor plant design effort. Chapter 5, 'Eliminating the Maintenance-Related Barriers,' outlines the 
methodology used to address those surveillances categorized as requiring an on-line performance 
mode or elimination. 
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Chapter 5 


Eliminating the Maintenance-Related 
Barriers 

5.1 Introduction 

This chapter presents the resolution methodology which is utilized to assist in resolving the 
identified operating cycle length barriers. It is structured as a flowchart, which methodically and 
systematically evaluates the current state of the design against the requirements, objectives, and 
goals. In Section 5.4, each of the decision points and process are described. The intent of devel¬ 
oping this methodology is not to introduce new factors for the designer to consider, but rather to 
organize the relevant factors into a methodology which will assist in identifying where the design 
effort should be focused. 

5.2 Establishing the Solution Space 

To ensure that IRIS maintenance considerations are evaluated in the design process, the main¬ 
tenance requirements must be identified prior to, or concurrent with, the design formulation. 
However, for a design such as IRIS which will deviate significantly from current commercial PWR 
practice, these requirements are not well known. These maintenance requirements, although not 
nearly as well defined as the known limitations of operating PWR components, represent poten¬ 
tial barriers to attaining the IRIS objectives. 
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Figure 5-1: Resolution of Maintenance Related Barriers Relevant to IRIS Design 


The maintenance-related barriers will be identified using a concurrent top-down and bottom- 
up approach. The top-down approach starts with the operating PWR and identifies barriers based 
on maintenance requirements and component operating history (Chapter 3, 'Operating Pressur¬ 
ized Water Reactor Surveillance Program'). The bottom-up approach starts with the IRIS design 
requirements to determine the best design solutions to meet the design requirements. It is the 
IRIS design requirements and solutions that determines which operating PWR systems and com¬ 
ponents could potentially find use in IRIS. From this aggregate set of components/systems and 
their accompanying maintenance-related barriers, the preferred method of resolution (evolution¬ 
ary or revolutionary design) will be identified. This is shown graphically in Figure 5-1. 






5.3 Resolving the Barriers 


The designer can deal with maintenance-related barriers in one of three ways: 

1. Modification : Modify the component such that the barrier no longer exists {evolutionary de¬ 
sign), 

2. Substitution : Perform the limiting component's function using a different component that is 
not subject to the limitation (combination of evolutionary and revolutionary design), or 

3. Replacement: Use an entirely different method to perform the fimctional requirement {revo¬ 
lutionary design). 

The method to be utilized depends on a number of factors including cost, technical risk, en¬ 
gineering feasibility, and effectiveness. It is not possible to determine the best method without 
considering all of these factors. 

5.4 Resolution Methodology 

This section presents the resolution methodology used to synthesize the requirements into de¬ 
sign solutions. It is, and is intended to be, general in nature for maximum applicability. Design 
inherently requires a high degree of creative thought and engineering judgment, and these in¬ 
tangibles cannot be captured in any methodology. What is asserted is that given a framework to 
guide this creativity, innovative solutions can more readily be developed. 

With the inputs providing the requirements, the methodology must systematically address 
all the imposed requirements to generate design solution alternatives for consideration by the 
systems engineer in the overall design. This resolution methodology should perform as a transfer 
function, inputting the cumulative set of requirements and outputting possible solutions meeting 
the requirements. To be of utility to the systems engineer, the design solution alternatives must 
also be qualitatively ranked by maintainability. 

The design resolution methodology flowchart is organized into three sequential figures, as 
shown in Figure 5-2. The flowchart is presented in Figures 5-3 through 5-5.^ Conceptually, the 

'The legend in Figure 5-3 applies to all three figures. 
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Figure 5-2: Design Resolution Methodology Flowchart - Layout 











flowchart sequentially and logically steps through the inputs described in Section 2.2 ('Methodol¬ 
ogy Inputs') and identifies where design effort must be focused: 

• Figure 5-3 s)mthesizes the requirements and evaluates what level of design effort is required 
(use existing component, modify component, or design new component). 

• Figure 5-4 synthesizes maintainability into the design to resolve when and how the compo¬ 
nent will be maintained. 

• Figure 5-5 s)mthesizes the economic and investment protection constraints to fully meet all 
design objectives. 

The various decisions and processes of the Design Resolution Methodology Flowchart are dis¬ 
cussed in more detail below: 

5.4.1 Decisions 

This is the fundamental question that determines whether or not a currently used 
component can be used in the IRIS application. If this is the first iteration, the 
component currently used to meet these functional requirement is input for con¬ 
sideration. This is a logical starting point, since design effort should only be 
expended if necessary to minimize the number of unproven components in the design. In most 
cases, the component currently used will meet the functional requirements in the IRIS application 
leading to an attempt to use the component. Subsequent passes through the methodology will 
lead to modifications to the currently used component or a new component or system. 

If the currently used component fails to meet the functional requirements (first 
iteration) or result in a feasible design (subsequent iterations) then the next iter¬ 
ation looks for modifications to the currently used component. Since the limita¬ 
tions of the currently used component have been identified by the methodology 
(either upon entry to the flowchart or after a complete iteration loop), the scope of the necessary 
changes are apparent to the designer. The anticipated commercial manufacturing capability is 
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used to determine feasible component modifications which will meet the requirements. This is 
the first point in the methodology where creative (evolutionary design) effort is required. 

If the component under consideration cannot be modified to satisfy the require¬ 
ments, then a new (revolutionary design) approach to the requirements is re¬ 
quired. At this point, the designer must turn to emerging materials and/or tech¬ 
nologies and seek a creative design solution. If a new component or system can¬ 
not be developed, then the functional requirements must be re-evaluated and distributed among 
several components. 

This is the first assessment of the design against the ultimate goal, operation 
throughout the entire cycle without requiring a plant shutdown for maintenance. 
To reach this point a component, group of components, or system has been con¬ 
ceived which meets the specified functional requirements. The component is 
evaluated against the regulatory requirements, with bias given (if an existing component is be¬ 
ing used) to the maintenance history of the component. If the component is not substantially 
modified, then the existing regulatory requirements will likely still be applicable. However, if sig¬ 
nificant component modification has occured (or a new component designed) then the regulatory 
requirements must be postulated from the regulatory intent (Section 2.2.2, 'Regulatory Require¬ 
ments'). 

If the design meets the operating cycle length requirement, then no maintenance is required for 
the cycle duration and the design proceeds to economic-related evaluation. If the component does 
not meet the operating cycle length requirements, due to either performance history or regulatory 
requirements, then a method of maintaining the component during the cycle must be developed. 

If the role of the component in overall operations is such that the component 
can safely be isolated for maintenance, then the component will be evaluated for 
at-power accessibility. In this case, often times all that is required is to install 
sufficient capability to isolate the component from the system. However, some 
components cannot be secured at power and require plant shutdown. If the component cannot 






be isolated, then a method of maintaining the component on-line must be developed to avoid the 
necessity for plant shutdown to maintain that component. 

Components that reach this point are those that can be safely taken out of ser¬ 
vice for maintenance. If the component is accessible then the component can be 
isolated and maintained on-line, and the design proceeds to economic-related 
evaluation. However many components, particularly those inside the contain¬ 
ment building, will be inaccesible due to a high temperature or high radiation environment. For 
these components, an on-line maintenance capability must be provided. 

Components that reach this point are those that require an on-line maintenance 
method. On-line maintenance methods are input; existing methods for the first 
iteration and proposed methods for subsequent iterations. If a suitable on-line 
maintenance method is available (or proposed), then the design proceeds to 
economic-related evaluation. If, however, a suitable on-line maintenance method is not available 
then evaluation of other at-power maintenance methods is conducted. 

Installation of redundacy often solves the maintainability issue for small com¬ 
ponents which cannot be removed from service at power, such as pumps and 
valves. For larger components, such as heat exchangers and turbine generators, 
this becomes cost prohibitive. However, in the development of design alterna¬ 
tives, installation of redundancy may be the only solution for at-power maintenance. 

Note that installation of redundancy is only effective for components that are accessible at- 
power unless sufficient 'installed spares' are provided (to operate when rurming components are 
'retired' in-place) to achieve the desired operating cycle length. If redundancy cannot be provided, 
then a new on-line maintenance method must be developed for this component. 



(Fig.W) 
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When all attempts at making the component maintainable at power through 
modifications and configuration changes fail, a new on-line method for main¬ 
taining the component must be developed. Like installation of redundancy, this 
path may lead to an economically non-viable solution. 

Often, technologies which may lead to at-power maintainability are only in the early stages of 
development and thus require an investment (which is ultimately reflected in the total plant cost) 
to adapt these developing technologies for the required application. If an on-line method can 
be developed, then the design proceeds to economic-related evaluation. If not, then this design 
alternative is not viable in it's current state and so another iteration begins. 

This is the final check of the design alternative to ensure that, after determina¬ 
tion of the investment protection surveillance requirements, the desired operat¬ 
ing cycle length can still be achieved. A component which reaches this point in 
the methodology can only fail to reach the desired operating cycle length due to 
investment protection concerns. If this is the case, then the alternative is not feasible in it's current 
state and so another iteration begins (with the a priori knowledge of the investment protection 
surveillance requirements). 

The investment protection requirements potentially could be changed to be consistent with 
the desired operating cycle length. However, the investment protection surveillance requirements 
are determined based on risk to the owner and are independent of the desired operating cycle 
length. The designer must resist the temptation to modify these requirements to make the design 
compatible with the desire operating cycle length unless the risk to the owner is re-evaluated, 
and this should only be done after another iteration through the methodology (which will now 
consider the investment protection surveillance requirements). 
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If all possible design alternatives have not been generated (i.e., consideration 
of existing component, modified component, and new component(s)) then the 
process is restarted without bias towards previously generated alternatives. If 
all feasible design alternatives have been generated, then the design alternatives 
are ranked by economic feasibility and maintainability and the procedure is exited. 

5.4.2 External Processes 

Component modification seeks to make a minor change to the component that 
is with current manufacturing capabilities. The objective of this process is to 
make the changes necessary to meet the fvmctional (first iteration) or cumulative 
(subsequent iterations) requirements specified for the component without also requiring a new 
manufacturing process. In some cases, the necessary changes can be met by an existing component 
developed for a different application. If not, then a custom manufacturing process (based on 
existing manufacturing practices) will need to be developed. 

If a current component cannot be modified to meet the specified functional re¬ 
quirements, then a new component must be designed. This typically requires 
significantly more creative design effort than simple component modification, 
but can result in a component better suited for the specific application than a modified existing 
component. Although design of a new component matches requirements to functionality, devel¬ 
opment and testing of the new component typically involve more time and cost than modification 
of an existing component. 

When a component simply cannot be isolated for maintenance during the op¬ 
erating cycle without a shutdown, then a means of maintaining the component 
on-line must be developed. In many cases, the maintenance actions required to 
be performed are inspections which allow predictive techniques to be used in estimating the re¬ 
maining length of satisfactory operation of the component. Depending on the basis for conducting 
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the maintenance (regulatory requirement or investment protection), development of an alternative 
inspection method which provides equivalent data on the overall health of the component may 
be acceptable. 

Recent focus on predictive maintenance techniques has resulted in development of new meth¬ 
ods for assessing component wear and performance. However many of these technologies, al¬ 
though promising for future use, are not sufficiently developed to transition into an actual field 
application. Therefore, utilization of these immature technologies will require time and money to 
research, develop, and test the technology for field application. 

Installation of redundancy is the simplest of the methods for creating an at-power 
maintainable component, so long as the component is accessible. The obvious 
drawback to this method is capital expenditure for installed spare components in 
the parallel path(es), especially for large components like heat exchangers and turbine generators. 
Some systems, such as those that are normally subject to large deviations from their nominal 
operating point, lend themselves well to installation of redundancy. An example is a cooling water 
loop, where the number of pumps required to be in operation is dependent on the temperature of 
the cooling medium. 

Most components that can be taken out of service for at-power maintenance can 
be made accessible by physically moving the component to an accessible loca¬ 
tion. High temperature or radiation inside the containment vessel are the most 
common reasons that a component is inaccessible.^ Moving the component to an accessible often 
requires only an additional length of piping or cabling, with appropriate consideration given to 
the impact of that addition to the overall design. 


Configure compo¬ 
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for on-line mainten¬ 
ance at power 
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to allow component 
to be removed 
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{Fig. 5^) 







^The IRIS vessel is a large integral vessel with internal radiation shield plates located in a 1.5 m annulus. Prelimi¬ 
nary calculations indicate that, due this thick shielded water annulus, the dose rate adjacent to the vessel during high 
power operation will be near background. The compact containment design, however, may result in high temperatures 
(especially at high elevations within the containment). 
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Evaluation of the economics of a design decision is a complex process which in¬ 
volves both capital and O&M cost considerations. The viability of a design, and 
the design decisions made along the way, depend strongly on the owner's finan¬ 
cial goals and objectives which are usually not well known during the design phase. Therefore, a 
baseline 'owner profile' must be established to place the other external factors (such as projected 
market conditions or the cost of borrowing money) in perspective. 

This economic analysis is beyond the scope of this thesis, but is included in the methodol¬ 
ogy for completeness. What can be qualitatively asserted, however, is the relative economic risk 
and benefits of one design alternative over another. In later chapters of this thesis, this qualita¬ 
tive assessment will be substituted for detailed economic analysis when evaluating IRIS design 
alternatives. 

The investment protection surveillance requirements applicable to a particular 
design alternative, like economic viability, are strongly dependent on the owner. 
In this case, the owner's economic risk threshold directly influences the amount 
of investment protection maintenance to be conducted. In general, large capital expenditure com¬ 
ponents and those components whose operation is directly linked to plant output receive the most 
maintenance attention. For these components, failure typically results in plant down-time and 
high component repair or replacement costs. As with the economic analysis, this thesis can only 
qualitatively estimate the investment protection surveillance requirements that a baseline 'owner 
profile' would establish. 

The methodology produces several design alternatives for consideration in the 
overall plant design. Ranking these alternatives by economic viability and over¬ 
all maintainability is essential to identify the relative advantages of one alterna¬ 
tive over another. However, like the economic viability and investment protection surveillance re¬ 
quirements assessment this ranking directly depends on the preferences of the prospective plant 
owner. Therefore, this ranking of alternatives (particularly the assessment of 'maintainability') 
will be only qualitatively performed. 
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5.5 Summary 


The design resolution methdology described above and presented in Figures 5-3 through 5-5 
systematically and methodically incorporates the design requirements, goals, and objectives into 
design alternatives which are then assessed against the specified constraints. The output from the 
methodology is a set of design alternatives which are ranked according to economic feasibility 
and maintainability. 

The methodology presents a general framework of factors to be considered when resolving 
identified maintenance-related barriers to a specified operating cycle length. A nuclear reactor 
plant is a complex group of diverse systems and components. The methodology is therefore gen¬ 
eral enough to generate design alternatives to resolve a broad spectrum of barriers, yet structured 
enough to focus the design effort on the important factors and considerations. 

In the remaining chapters, the methodology is applied to resolve the barriers identified in 
Chapter 3. To illustrate application of the methodology. Chapter 7, 'Application of Resolution 
Methodology-Reactor Vessel Overpressure Protection,' will explicitly step through the method¬ 
ology flowchart presented in Figures 5-3 through 5-5 (pages 73 through 75). The other chapters 
present only a summary of the relevant factors and the methodology output. 
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Figure 5-3: Design Resolution Methdology Flowchart - Synthesis of Requirements 
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Figure 5-4: Design Resolution Methdology Flowchart — Synthesis of Maintainability 
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Figure 5-5: Design Resolution Methdology Flowchart - Synthesis of Constraints 
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Chapter 6 


Resolution of Identified Barriers 

6.1 Introduction 

In Chapter 3, 'Operating Pressurized Water Reactor Surveillance Program/ the maintenance 
related barriers preventing an operating PWR from attaining an extended operating cycle were 
presented. This chapter addresses, in general terms and within the context of the IRIS design, the 
Category C surveillances identified by the MIT Extended Fuel Cycle Project which can neither be 
performed on-line nor have their performance intervals extended to 48 months. Where a potential 
solution is readily apparent, it is presented. Several barriers require additional design effort and 
are discussed separately in Chapters 7 through 11. 

Many of the components and systems identified by the MIT Extended Fuel Cycle Project re¬ 
quire testing and maintenance because of their role in ensuring safety. Evaluation of these com¬ 
ponents and systems using the methodology of Chapter 5 assisted in the conceptual development 
of a passive emergency heat removal system which could be tested at power. This system is de¬ 
scribed in Section 6.3, and the integrated testing and coordinated maintenance which it enables 
is described in Chapter 11, 'Application of Resolution Methodology-Reduced Power Window 
Surveillances.' 



6.2 IRIS Resolution of Identified Surveillances Requiring Reduced Power 
or Plant Shutdown 

6.2.1 IRIS Resolution of Regulatory Based Surveillances Requiring Plant Shutdown 

6.2.1.1 In-Service Testing 

Reactor Vessel and Primary System Component Relief Valve Testing Overpressure protection 
for the IRIS vessel is described in Chapter 7, 'Application of Resolution Methodology-Reactor 
Vessel Overpressure Protection/ 

Operability and Engineered Safeguards Response Time Testing Integrated safety system time 
response testing will be required in IRIS. The conceptual IRIS passive cooling system (Section 6.3, 
below) is designed to be tested on-line (at reduced power) for 100% system operability demon¬ 
stration. This passive cooling system is similar to the AP600 passive cooling loop, but is connected 
to the secondary loop rather than the primary loop. The specified testing periodicity for AP600 
passive safety systems is off-line every two years, with quarterly operability checks deferred to 
the off-line period. With an on-line testing method it is anticipated that the quarterly operability 
checks will not be deferrable. Some of these operability checks, however, will require reduced 
power and are thus vmdesirable. 

An integrated testing program is proposed (Chapter 11, Section 11.3) that performs limited 
operability testing quarterly and complete system operability testing every four years.^ Quarterly 
assurances (which are currently deferred) that key components are functional reduce the uncer¬ 
tainty that the system will perform when required. This strategy of more frequent limited testing 
allows a longer 100% system operability demonstration performance interval, possibly as long as 
eight years. 

Safety System Valve Operability Checks Valve operability checks will be conducted via the 

comprehensive safety system operability testing of Chapter 11, Section 11.3. AP600 safety sys- 

’The IRIS strategy is to perform more thorough quarterly checks (which are not power limiting) and defer the com¬ 
plete system operability test as long as feasible. However, as will be seen in Chapter 8, 'Application of Resolution 
Methodology-Steam Generator Tube Inspection,' steam generator tube integrity inspections are the limiting inspec¬ 
tions which make deferral of the complete safety system operability testing longer than the steam generator inspection 
interval unnecessary. 



terns have a limited number of MOVs, utilizing air operated and Squibb (explosively actuated) 
valves where MOVs have been traditionally been used. IRIS will also apply this design practice, 
minimizing or eliminating the use of safety grade motor operated valves. 

It should be noted that during the regulatory review of the AP600 design, a new regulatory 
category was created for non-safety systems. This category. Regulatory Treatment of Non-Safety 
Systems (RTNSS), applies regulatory controls to non-safety systems which are used preferentially 
to safety systems when available. As there has been no AP600 plant built, it is unclear as to what 
the ultimate scope of the RTNSS program will be and how it will impact IRIS. 

6.2.1.2 Containment Safety Features Response Time Testing 

The IRIS containment design, which is largely borrowed from AP600, allows complete on-line 
integrated containment safety feature operability testing. This testing will be integrated into the 
comprehensive IRIS passive safety systems operability testing program described in Chapter 11, 
Section 11.3. 

6.2.1.3 Steam Generator Eddy Current Testing 

Steam generator tube integrity inspection is described in Chapter 8, 'Application of Resolution 
Methodology-Steam Generator Tube Inspection.' 

6.2.1.4 Emergency Core Cooling Systems 

These operability tests will be performed on-line (at reduced power) by the integrated 100% 
passive safety system operability demonstration of Chapter 11, Section 11.3. 

6.2.2 IRIS Resolution of Nuclear Steam Supply System Investment Protection Surveil¬ 
lances Requiring Plant Shutdown 

6.2.2.1 Component Cooling System Relief Valve Testing 

Overpressure protection of individual components in the component cooling system will be 
required to prevent over-pressurizing an isolated component due to thermal expansion. These 




components can be protected by having a thermal relief check valve in parallel with the down¬ 
stream isolation valve to ensure that isolated component pressure never exceeds component cool¬ 
ing water system pressure. This thermal relief check valve arrangement eliminates the need for 
individual component relief valves, and ensures that the component cannot be inadvertently over¬ 
pressurized if it is isolated from the component cooling water system. For components which 
are connected to a higher pressure source, such as the reactor coolant pump stator jacket, the 
component must be manually isolable from the higher pressure source to prevent a leak into the 
component cooling water system from over-pressurizing the entire system. 

6.2.2.2 Chemical and Volume Control System Relief Valve Testing 

This particular surveillance is eliminated by design. Component overpressure protection will 
be provided as described in Section 6.2.2.1. 

6.2.2.3 Reactor Coolant Pump Lubricating Oil 

These surveillances are eliminated by design. The reactor coolant pumps will be of a sealed 
motor design and are lubricated by primary coolant. 

6.2.3 IRIS Resolution of Balance of Plant Investment Protection Surveillances Requir¬ 
ing Plant Shutdown 

6.2.3.1 Auxiliary Systems Relief Valve Testing 

Component overpressure protection will be provided as described in Section 6.2.2.1. 

6.2.3.2 Condenser Waterbox Cleaning 

Condenser waterbox cleaning is described in Chapter 9, 'Application of Resolution Methodology- 
Main Condenser.' 

6.2.3.3 Main Steam Safety Valve Testing 

The main steam safety valves are ASME Class 1 valves, and will be resolved in a similar 
manner to reactor vessel overpressure protection (Chapter 7). 



6.2.4 IRIS Resolution of Surveillances Requiring Reduced Power in the Extended 
Fuel Cycle Project 

Resolution of surveillances requiring reduced power are described in Chapter 11, 'Application 
of Resolution Methodology-Reduced Power Window Surveillances.' 

6.3 IRIS Emergency Heat Removal System 

Implicit in the resolution of the regulatory based surveillances is the observation that, at some 
point, a 100% demonstration of the operability of all safety features must be performed. A passive 
cooling system for use in IRIS, similar to the AP600 passive cooling loop, is shown in Figure 6- 
1. Four loops will be utilized, with each loop's heat removal capability roughly equal to one- 
third of the total heat removal burden. This allows one passive cooling loop to be retired in-place 
during the operating cycle if necessary due to either failure of the cooling loop or failure of the 
corresponding steam generator. 

Each passive cooling loop consists of isolation valves, an expansion tank, and a heat exchanger. 
When the isolation valves are opened, natural circulation causes water to be forced into the steam 
generator through the feed header. The cooling water is heated (or boils) and flows, due to the 
natural circulation head developed, back to the heat exchanger. Heat is transferred to the heat ex¬ 
changer tank, which is vented to atmosphere and contains sufficient water to prevent evaporation 
from lowering the tank water level to the tube bundle. The steam generator water addition tank 
supplies makeup water to the passive cooling loop (which will be necessary as the bulk water 
temperature is reduced) to prevent loss of natural circulation head. 

The strategy for testing the IRIS passive cooling loops is presented in Chapter 11, Section 11.3, 
'IRIS Integrated Testing and Coordinated Maintenance.' 

6.4 Summary 

All of the four year cycle length barriers identified by the MIT Extended Fuel Cycle Project 
have been addressed in the context of IRIS. Although all solutions have not been addressed by 
detailed design, discussions with IRIS design engineers indicate that the problem is now suffi- 
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ciently bounded to readily and efficiently develop viable design solutions. The only cycle length 
barriers which cannot be readily solved are:^ 

• Primary relief valve testing, 

• Steam generator eddy current inspection, 

• Condenser waterbox maintenance, 

• Main turbine throttle control maintenance, 

• Safety system testing, and 

• Reduce power window items. 

These items are discussed in the following chapters. 


^Note that rod control system testing also presents a significant operating cycle length barrier. However, the IRIS 
core design has not been completely specified and therefore adequate rod control system requirements cannot yet be 
specified. 
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Chapter 7 


Application of Resolution 
Methodology-Reactor Vessel 
Overpressure Protection 

7.1 Introduction 

This chapter discusses the impact of providing overpressure protection on the IRIS operating 
cycle length goal. The methodology of Chapter 5 will be explicitly applied to demonstrate it's 
applicability. The design alternatives proposed were not generated by a single pass through the 
methodology flowchart, primarly due to the high impact of regulatory requirements on the design. 
Therefore, this chapter begins with a discussion of the regulatory requirements so that the reader 
can observe this impact on the alternatives generated. 

7.2 Regulatory Requirements 

The requirement to provide system overpressure protection is given by the American Society 
of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code, hereafter referred to as the Code. 
Section III, Division 1-NB, Article NB-7000 of the Code provides requirements for Class 1 com¬ 
ponents with similar requirements existing under the Code for all other classes of components. 
Overpressure protection is currently provided for reactor vessels using two (or more) pressure 
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relief valves.^ 

Pressure relief valve testing is conducted in accordance with the "Operations and Maintenance 
of Nuclear Power Plants, ASME/ANSI (American National Standards Institute), OM-1987" Chap¬ 
ter 1. Under OM-1987, the owner/operator has the option of testing the pressure relief valve in- 
place or replacing the pressure relief valve with a bench tested spare. Most plants opt to replace 
the pressure relief valve with a bench tested spare during a scheduled outage rather than test in- 
place because it places the individual system out of service for a shorter period of time. In general, 
the time required for testing (setup, conducting the test, and restoring the system) is comparable 
to the time required for pressure relief valve replacement (setup, valve removal, valve installation, 
and restoring the system). However, using the bench tested spare (which has already passed it's 
lift test) removes any scheduling uncertainty associated with the repair or replacement of a pres¬ 
sure relief valve which fails it's in-place test. Currently, all pressure relief valve testing on active 
systems (those required to be active when the reactor is on-line, such as pressurizer relief valves) 
is conducted with the reactor shutdown. 

The operation of a pressure relief valve is characterized by the Code using three parameters: 
set, lift, and blowdown. Set is the set pressure at which the pressure relief valve begins to open. 
The Code specifies a set pressure tolerance based on operating system pressure, and for typical 
PWR conditions (including IRIS) the tolerance is ±3%. Lift pressvure is the pressure at which the 
pressure relief valve is fully open, and rated relief capacity is attained. The Code specifies that 
pressure relief valves shall attain rated lift at a pressure which does not exceed the set pressure by 
more than 10%. Blowdown is the pressure at which the pressure relief valve fully reseats. The Code 
does not specify a value for blowdown. Rather, the Code requires the blowdown not to exceed that 

’The following definitions are provided from Section III, Division 1-NB, Article NB-7000 of the Code: 

• A pressure relief valve is a pressure relief device which is designed to reclose and prevent the further flow of fluid 
after normal conditions have been restored. 

• A safety valve is a pressure relief valve actuated by irJet static pressure and characterized by rapid opening or 
pop action. 

• A safety relief valve is a pressure relief valve characterized by rapid opening pop action, or by opening generally 
proportional to the increase in pressure over the opening pressure. 

• A relief valve is a pressure relief valve actuated by inlet static pressure and having a gradual lift generally pro¬ 
portional to the increase in pressure over opening pressure. 

• A pressure relief device is designed to open to prevent a rise of internal fluid pressure, greater than a specified 
value, resulting from exposure to pressure transient conditions. It may be a pressure relief valve or a nonreclos¬ 
ing pressure relief device. 
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value which the designer has determined (and specified in the Overpressure Protection Report) to 
be the minimum reseat pressure. 

ASME/ANSI, OM-1987 requires that all Class 1 Pressure Relief Devices (which includes the 
pressurizer relief valves) be tested: 

• Prior to initial installation. 

• Within the initial 5 year operating period according to the following schedule: 


Minimum Cumulative % 
of Valves of Each Type and 
Time Period Manufacture to Be Tested 


Startup 

—12 months 

0 

13 months 

— 24 months 

25 

25 months 

— 36 months 

50 

37 months 

— 48 months 

75 

49 moi'.ths 

— 60 months 

100 


Additionally, a minimum of 20% of the valves of each type and manufacture shall be tested 
within any 24 months. This 20% shall be previously imtested valves, if they exist. 

• During subsequent 5 year periods such that all valves of each type and manufacture shall be 
tested with a minimum of 20% of the valves tested within any 24 months. This 20% shall be 
previously untested valves, if they exist. 

7.2.1 Eliminating the Need for Overpressure Protection by Design 

Section NB-7110 of the Code, "General Requirements: Scope" specifies that "a system shall 
be protected from the consequences arising from the application of conditions of pressure and 
coincident temperature that would cause either the Design Pressure or the Service Limits specified 
in the Design Specification to be exceeded." Specifically excluded from the scope of the Article are 
the effects of extremely short duration pressure increases (such as water hammer) and the design 
of reactor shutdown systems. 

Within NB-7110, there exists the possibility that a system could be designed that would not 
be subject to conditions which lead to exceeding either the Design Pressure or the Service Limits 
specified in the Design Specifications. The IRIS design is a large integral reactor vessel with a large 
steam space, and design solutions could be sought which meet the Code requirements. However, 
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it is unlikely that a nuclear power plant could be designed in this manner since the energy stored 
in the fuel can, imder certain conditions, be released in a rapid enough manner as to cause an 
unacceptably high peak pressure. Other plausible conditions, such as a sudden loss of steam 
demand, can create a rapidly rising pressure condition which may require intervention to prevent 
exceeding the Design Pressure or Service Limits. 

Acknowledgement of the need for overpressure protection in accordance with the Code, then, 
requires compliance with the Code. As written. Article NB-7000 is almost entirely devoted to 
pressm-e relief valves. Within the category of pressure relief devices required by the code are both 
pressure relief valves and nonreclosing pressure relief devices. Within nonreclosing pressure re¬ 
lief devices, rupture disk devices are the only devices addressed. However, rupture disk devices 
are not permitted to be used as the sole pressure relief device. It appears, then, that the intent of 
the Code is to ensure that a pressure relief valve is used in the overpressure protection scheme. 
Therefore, the opinion of the IRIS design team is that amount of effort required for the develop¬ 
ment, testing, and validation of a pressure self-mitigating vessel would be better spent seeking 
other (less revolutionary) design solutions. 

7.3 Synthesis of Requirements 

7.3.1 Functional Requirements 

To protect the reactor vessel and attached piping from potential overpressure conditions (which 
could ultimately lead to catastrophic failure), overpressure protection is required. The capacity of 
the overpressure protection device must be great enough to arrest the design basis pressure rise 
and ensure that the design maximum pressure is not exceeded. For the IRIS design resolution 
we seek, the overpressure protection device must either be maintainable on-line or not require 
maintenance for the entire eight year operating cycle. 

7.3.2 Currently Used Component — Pressurizer Relief Valve 

All currently operating PWR plants use a pressurizer, located above the reactor vessel eleva¬ 
tion and typically connected to one of the reactor coolant cold legs, to maintain reactor coolant 
system pressure. The pressurizer is a heated vessel that acts as a head tank or surge volume to 
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mitigate system pressure transients. Overpressure protection for the reactor coolant system is pro¬ 
vided by two or more relief valves directly connected to the pressurizer steam space. The reason 
for using a steam relief valve (vice a water relief valve) is two-fold: (1) less mass is lost from the 
system for a given pressure reduction upon actuation, and (2) there is less chance of fouling the 
valve seat (by corrosion products) during reseating. 

Does existing component meet requirements? Based on the experience at the candidate oper¬ 
ating PWR, as well as limited interviews with personnel at other plants, the relief valves in service 
today are unlikely to operate reliably for the entire IRIS cycle length. The pressurizer relief valve 
meets the IRIS overpressure protection functional requirements but, based on the above regula¬ 
tory testing requirements, cannot meet the IRIS cycle length objective. To conduct pressurizer 
relief valve testing with the reactor at power requires either of the following: 

• the capability to isolate and remove the valve from the system for bench testing, 

• the capability to test the valve in-place (either isolated or unisolated from the primary sys¬ 
tem), or 

• testing the unisolated valve in-place by raising system pressure to the valve lift point. 

Employment of any of these methods is likely to require submittal of a Code case to the ASME, 
since these methods are not explicitly permitted by the code. However, Article NB—7142 does 
specify requirements to be met if an isolation valve is to be utilized and hence a solution may be 
found that is within the scope of the current Code. 

7.3.3 Component Modification 

Can existing component be modified to meet requirements? There are modifications which 
can be made to the pressurizer relief valve to allow for on-line testing. Potential modifications are 
described below. 

7.3.3.1 Spring-Loaded Relief Valve 

The spring-loaded relief valve, shown in Figure 7-1 (a), is the most commonly used overpres¬ 
sure protection device. An unmodified spring-loaded relief valve meets the functional require¬ 
ments to provide overpressure protection for the reactor vessel but cannot meet the IRIS eight 


89 




year cycle length objective due to the regulatory requirements which specify more frequent test¬ 
ing (Section 7.2). The design issue to resolve is whether the relief valve can be taken out of service 
for on-line testing. Based on the safety role that the valve performs, overpressure protection can¬ 
not be suspended even for short time periods. Therefore, a method to test relief valves while 
maintaining reactor vessel overpressure protection must be utilized. 

7.3.3.1.1 On-line Spring-Loaded Relief Valve Testing Several Engineering Services compa¬ 
nies^ provide on-line testing of simple spring-loaded safety and relief valves under normal op¬ 
erating pressure and temperature. It is primarily utilized in the nuclear industry for shutdown 
in-place testing of main steam safety valves where it is not feasible (due to time and expense) to 
remove the valve from the system, and full test pressure cannot be obtained to lift the valve. In- 
place assisted lift testing is limited to those applications where the valve is accessible for testing, 
the valve outlet can be monitored for leakage, and a lift assist device with reduced system pres¬ 
sure can be used to actuate the valve (since system pressure can not be used to achieve the set 
pressure of the valve). Assisted lift testing is currently only practical for valves in systems with 
highly compressible media, such as gas or steam. This method is not currently used to test water 
valves since the outlet of the valve usually cannot be observed for flow and determination of valve 
set and lift to the required accuracy is not possible. 

Using the simplifed spring-loaded relief valve drawing of Figure 7-1, assisted lift testing is 
conducted according to the following (simplified) procedure. First, the valve set pressure and 
current system pressure are compared to determine the expected pressure difference. Using valve 
nameplate data, this pressure is converted to a force (pull) and the appropriate range load cell is 
selected and calibrated. The valve cap is removed, and the lifting mechanism (with load cell) is 
attached to the valve stem. Flow sensors, which allow detection of the valve set, lift, and blow¬ 
down, are attached to the discharge piping near the valve body. While monitoring the discharge 
piping for flow, the lift mechanism pulls the disk (via the valve stem) against the valve spring 
until set is detected. Once set is determined, the lift mechanism opens the valve further until full 
flow (lift) is detected. Finally, the valve is unloaded and blowdown is measured. Again using the 
valve nameplate data, the measured forces are converted to pressures and added to the measured 
^For example, Furmanite. 
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Figure 7-1: Assisted Lift Relief Valve Testing — Simplified Drawing 


system pressure to determine the valve set, lift, and blowdown. 

Assisted lift testing has two distinct advantages. First, since the testing is conducted at an ac¬ 
tual system pressure less than the set pressure there is a large differential pressure across the valve 
disk once the lift mechanism releases the valve stem. This ensures that the valve disk reseats 
quickly and positively, without the valve chatter normally experienced when the applied pressure 
approaches the blowdown pressure. Second, the lift mechanism can force the valve closed if the 
valve sticks open after the valve stem is released by the lift mechanism. Although assisted lift 
testing of pressurizer relief valves has never been conducted at power, these advantages could 
mitigate the risk of excessive coolant loss for a stuck open relief valve. For IRIS, the relief valves 
would either need to be made accessible (so personnel could connect the lift mechanism) or re¬ 
designed to incorporate the lift mechanism in the valve. Even if the lift mechanism is permanently 







installed, the process cannot be completely automated since calibration of the lift mechanism load 
cell is required prior to testing. 

At least one additional relief valve should be installed in excess of the number specified in the 
Overpressure Protection Report to eliminate the potential need to conduct relief valve setpoint 
adjustments at power. If a single relief valve is found to be out-of-specification, then it can be 
gagged shut and operation can continue^ with the minimum number of relief valves specified in 
the Overpressure Protection Report. 

7.3.3.2 Pilot Operated Relief Valve 

A pilot operated relief valve (Figure 7-2) is a compound valve which uses a small pilot valve 
to direct high pressure system fluid to the operating piston of a large main valve. When the pilot 
valve opens and the underside of the operating piston is pressurized, the main valve spring is 
compressed allowing fluid flow through the main valve. The operation of the pilot valve is sim¬ 
ilar to the spring-loaded relief valve, but typically uses a corrugated bellows instead of a spring. 
When system pressure is reduced and the pilot valve closes, the high pressure in the main valve 
operating cylinder bleeds off allowing the main valve spring to force the main valve closed. The 
primary advantage of the pilot operated relief valve is that, unlike the spring-loaded relief valve, 
the main valve is not subject to near-zero differential pressure. Therefore, a large differential pres¬ 
sure always exists to rapidly close and seat the main valve. Testing of a pilot operated relief valve 
consists of determining the pilot valve operating characteristics and verifying that the main valve 
is not physically bound. 

The pilot operated relief valve could be configured using redundancy as discussed in Sec¬ 
tion 7.4.1.1 above. For this arrangement, both the pilot sensing line and main valve inlet line 
would be isolated from the system for testing. This permits both determination of the pilot valve 
operating characteristics and manually exercising the main valve stem. 

®OM-1987 has specific requirements for bench-tested relief valves which are found to be out-of-specification, but not 
for on-line tested valves. It does specify that the valve shall be repaired/replaced, the cause of failure shall be deter¬ 
mined and corrected, and the valve shall be satisfactorily retested prior to returning to service. For this configuration, 
with valve(s) installed in excess of the requirement, the out-of-specification valve will not be returned to service until 
the next operating cycle. However, the cause of failure will need to be determined to ensure that a common-cause 
failure will not disable all overpressure protection. 







7.3.3.3 Improved Relief Valve 


The primary limitation of cixrrent pressure relief valves (whether simple spring-loaded or pilot 
valve actuated) is setpoint drift. Current pressure relief valves operate by generating a force to 
compress a spring and lift the main disk off it's shut seat. Changes in material properties, corrosion 
buildup, and thermal effects all contribute to changes in valve actuation characteristics. Only 
through material advances can these deficiencies be corrected. However, since the industry does 
not have a need for these advanced relief valves there is no industry impetus to invest in the 
research and development necessary to field a relief valve which overcomes these limitations. 

7.3.3.4 Summary of Modifications 

Only two relief valve modifications are possible to meet the IRIS operating cycle length re¬ 
quirements: modification to allow on-line testing and modification to eliminate the need for test¬ 
ing. The first is most feasibly met through a modification which integrates an assisted lift mecha¬ 
nism into the valve (See Section 7.3.3.1.1). The second requires advances in materials technology 
to address the limitations that led to the current regulatory specified testing periodicity. 

7.4 Synthesis of Maintainability 

7.4.1 On-Line Maintenance 

Can component be maintained on-line? Yes, utilizing the assisted-lift device of Figure 7-1. 

System pressure, without assisted-lift, could be used to conduct relief valve testing. The Code 
requires an Overpressure Protection Report which describes the design basis pressure transient 
upon which the total relief capacity and setpoint is based. If system pressure is to be used for in- 
place relief valve testing, then the lift pressure (instead of normal system pressure) now becomes 
the starting pressure onto which is added the design basis pressure transient. This results in a 
lower relief valve setpoint which provides an insufficient to prevent inadvertent lifting during 
normal operating transients. Additionally, inadvertent depressurization becomes a greater risk if 
the relief valve fails to reseat. Using system pressure for relief valve testing, therefore, should only 
be considered if no other on-line testing method can be developed. 
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7.4.1.1 Installing Redundancy to Permit or Defer Testing 

Can redundancy be utilized to allow for maintenance? Although neither the ASME Code nor 
OM-1987 requires the reactor to be shutdown during relief valve testing, the rules do not explicitly 
permit isolation valves to be installed in the path of the relief valve. To the contrary, NB-7142 of 
the Code prohibits stop valve installation unless "such stop valves are constructed and installed 
with controls and interlocks so that the requirements of NB-7300 are met under all conditions of 
operation of both the system and the stop valves." 

Section NB-7300 of the Code addresses the required relieving capacity of installed pressure 
relief devices, which includes consideration of all relevant design and operating factors which 
may contribute to an overpressure condition. 

Figure 7-3 shows an arrangement which could meet the Code requirements while providing 
adequate isolation to conduct, via a test fitting, in-place testing. The key to this arrangement is the 
three-way valve which cannot simultaneously isolate both relief valves from the reactor vessel, 
even if the valve is inadvertently placed in a mid-position. The internal flow path is shown in 
Figure 7-4. Only when the valve is correctly aligned to one relief valve is the other isolated. To 
meet the Code requirements both valves must either be operational (since it is possible that an 
inoperable relief valve may be placed in service) or the valve physically prevented (via interlocks) 
from aligning the reactor vessel to an inoperable relief valve. 

With the addition of suitable interlocks, the arrangement of Figure 7-3 can be used to allow the 
second relief valve to act as an installed spare. Since there is no regulatory prescribed shelf-life for 
a tested relief valve that is not in service, the second valve can remain isolated from the reactor 
vessel until the first valve requires testing. Then, rather than testing the first valve, it is isolated 
and the second valve is placed in service. Suitable interlocks could consist of a stem locking device 
or weld. However, as with the three-way valve design a Code case will likely need to be submitted 
to ASME for evaluation. 

Can the component be isolated for maintenance? Yes, utilizing the arrangement of Figure 7- 
3. If the system is a high energy system, as is the case for the primary coolant system, then two 
upstream isolation valves and one downstream isolation valve (if the potential exists for reverse 
flow in the downstream piping from another source) are required for personnel safety. 

Isolation (or, in the nomenclature of the Code, stop) valves are not specifically prohibited by 








Retention Tank 

Figure 7-3: Redundant Spring-Loaded Relief Valves with ASME Boiler and Pressure Vessel Code 
Compliant Isolation 
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from reactor vessel 



from reactor vessel 



(a) Aligned to both relief valves (b) Aligned to one relief valve 

Figure 7-4: ASME Boiler and Pressure Vessel Code Compliant Isolation Valve Flow Path. In (a), 
flow is directed to both relief valves. In (b), flow is directed only to one relief valve with the other 
isolated for in-place testing. Angular travel of the valve ball is mechanically limited to prevent 
simultaneously isolating both relief valves from the reactor vessel. 


the Code. Rather, specification is made that these stop valves shall be constructed such that dur¬ 
ing normal operation the pressure relief device cannot be rendered inoperable. This, however, is 
exactly what is intended by the isolation valve described in Section 7.4.1.1. But, the isolation valve 
has two relief valves attached and one is always on service. Therefore, the intent of the Code is 
met since the isolation valve cannot isolate both relief valves simultaneously and the subsystem 
consisting of one isolation valve and two relief valves is considered a single pressure relief device. 

Can component be made accessible at power? Yes, based on the low anticipated dose rate (en¬ 
abled by the large vessel annulus and shield plates) inside the containment vessel during normal 
operation. 


7.5 Synthesis of Constraints 

Whether by assisted-lift testing or utilization of an isolation valve and redundancy, accessi¬ 
bility for testing is made possible by the low anticipated dose rate inside the containment vessel. 
Failure to provide overpressure protection for the reactor vessel is an unacceptable risk, and so 
investment protection concerns dictate that the testing frequency should be at least as frequent as 
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the regulatory requirement. However, the regulatory specified frequency is based on a significant 
amount of performance history, so the investment protection testing frequency is likely to not be 
more frequent. Therefore, the testing frequency of OM-1987 (and not more frequently) should be 
adopted for IRIS. 

Does design meet operating cycle length requirements? The methods described enable the 
target operating cycle length of eight years by providing a means for conducting testing with the 
reactor at power. 

Have all feasible design alternatives been generated? Creative design can continue to de¬ 
velop alternatives, but these are likely to be more complex and require accepting a higher technical 
risk. 

7.6 Summary 

This chapter has demonstrated the resolution methodology and presented several alternatives, 
for consideration in the IRIS design, which meet the eight year operating cycle length objective. 
The first two, assisted lift testing and installation of redundancy, utilize a current technology relief 
valve and conduct testing on-line and at power. The third alternative is to develop an improved 
relief valve that will perform satisfactorily for the entire IRIS operating cycle. The last alternative 
is to design IRIS to be pressure self-mitigating, and thus a pressure relief device would not be 
required. 

Table 7.1 summarizes the alternatives qualitatively ranked by maintainability, economic viabil¬ 
ity, and technology risk. For the four-year IRIS maintenance cycle one additional alternative exists, 
regulatory change, but is not included here since the objective is to design systems which can be 
maintained at power allowing much longer operating cycles. Within the alternatives generated, 
installation of redundancy presents the most feasible and cost effective solution. 



Table 7.1: Overpressure Protection Alternatives Summary 


V V Alternative 

Report 

Section 

Maintain¬ 

ability 

Anticipated 

Cost 

Techribldgy 

Risk 

Assisted lift testing of current technol¬ 
ogy relief valve 

73.3.1.1 

medium 

medium 

low 

Install redundancy and a code compli¬ 
ant isolation valve to permit in-place 
testing of isolated relief valve® 

7.4.1.1 

medium 

low 

low 

Utilize installed spares and a code 
compliant isolation valve to allow de¬ 
ferral of testing 

7.4.1.1 

high 

medium 

medium 

Design advanced relief valve which 
does not require maintenance during 
the operating cycle 

7.3.33 

high 

medium 

high 

Design reactor vessel system such that 
overpressure protection device is not 
required 

7.2.1 

high 

high 

high 


''Recommended alternative for use in IRIS. 
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Chapter 8 


Application of Resolution 
Methodology-Steam Generator Tube 
Inspection 


8.1 Introduction 

Steam generator tubing constitutes a significant portion of the reactor coolant pressure bormd- 
ary (RCPB). The design of the RCPB for structural and leakage integrity is addressed in either 
Title 10 of the Code of Federal Regulations (CFR), Part 50 (10 CFR Part 50), Appendix A or the 
licensing basis of a facility. The General Design Criteria (GDC) of Appendix A state that the RCPB 
shall "have an extremely low probability of abnormal leakage" (GDC 14), "shall be designed with 
sufficient margin to assure that the design conditions of the reactor coolant pressure boundary 
are not exceeded during any condition of normal operation" (GDC 15), and "shall be designed to 
permit periodic inspection and testing of important areas and features to assess their structural 
and leaktight integrity" (GDC 32). 
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The first two requirements will not be explicitly considered here, but certamly must be met 
by any steam generator design. IRIS is considering a modular helical-coildesign (eight modules 
arranged in the reactor vessel annulus) with u-tube configuration as the backup design.^ Regard¬ 
less of the configuration, the steam generator will have inlet and outlet channel heads (or a single 
inlet/outlet head) which are moimted to the reactor vessel for accessibility to meet the third re¬ 
quirement. This arrangement will allow access to the steam generator from the secondary side 
either through a manway or by removal of the entire channel head cover plate. Figure 8-1 shows 
the IRIS reactor vessel design with straight-tubed steam generators. The proposed moimting 
method is the same for all steam generator design types. 

Gaining access to the steam generator tubes is not a significant design obstacle. The design 
challenge is to create a steam generator which can be inspected at power, and ideally while in 
service. This chapter investigates this design challenge and potential solutions. 

8.2 Requirements 

The structural and leakage integrity of steam generator tubing is maintained through sev¬ 
eral defense-in-depth measures, including in-service inspection, tube repair criteria, primary-to- 
secondary leak rate monitoring, water chemistry control, operator training, and analyses to ensure 
that safety objectives are met. The degraded tubes must be removed from service (by plugging) 
or repaired if detected indications (flaws) exceed 40 percent of the nominal tube wall thickness 
as required in plant technical specifications. The indications are detected by periodic inspections 
using qualified nondestructive testing as required by Criterion IX in Appendix B to 10 CFR Part 
50. Eddy current technology, one method of nondestructive testing, is the primary means used by 
the industry to assess the condition of steam generator tubing. 

The eddy current inspection technique correlates the depth and length of an indication to sig¬ 
nal responses received by probes passing through the inside of the tube. Although the eddy cur¬ 
rent method is a proven technique for detecting the length of indications, there has been lim- 

’ In April 2001, the IRIS team evaluated several steam generator options (u-tube, c-tube, helical-coil, modular helical- 
coil, and straight-tube) and selected the modular helical-coil design as the primary design and the u-tube design as the 
backup design. Where IRIS is exploring innovative technologies which have not previously been used for pressur¬ 
ized water reactor application, such as the modular helical-tube steam generator, the technology risk is mitigated by 
concurrently developing a backup design which is based on current technology. 
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ited success in demonstrating its capability to accurately measure the depth of certain types of 
steam generator tube indications. Specifically, indications caused by intergranular attack (IGA) 
and stress-corrosion cracking are difficult to size with eddy current techniques because of a num¬ 
ber of complicating variables, such as oxide deposits, material properties and geometry, crack 
morphology, human factors, data analysis, and data acquisition practices. In one recent instance, 
a licensee sized the depths of IGA indications and removed from service those tubes with IGA 
indications exceeding the 40 percent through-wall repair limit. Data from subsequent destructive 
examinations of several degraded tube specimens removed from the licensee's steam generators 
during the outage indicated that the estimated through-wall extent of degradation in these speci¬ 
mens, based on eddy current, was significantly less than the true depth of the IGA indications.^ 

In order to successfully disposition steam generator tube degradation in accordance with the 
repair limits in the technical specifications and Appendix B to 10 CFR Part 50, the inspection pro¬ 
cess must be capable of (1) detecting indications of tube degradation, (2) characterizing the indica¬ 
tions, e.g., cracklike, IGA, manufacturing burnish mark, or wear and the orientation for cracklike 
degradation, and (3) accurately sizing the depth of degradation. The term "inspection process" 
refers to the use of one or a combination of nondestructive inspection techniques to evaluate a 
specific mode of steam generator tube degradation. This evaluation could potentially include 
three inspection methods (e.g., eddy current probes)-one for detection, one for characterization, 
and a third to size the indication. However, the successful qualification of the inspection pro¬ 
cess requires a qualification of each method (i.e., probes, cables, software, etc.) for the mode of 
degradation being evaluated in the steam generator tube examinations. Experience has demon¬ 
strated that for effective qualification the data set demonstrating the capability of the inspection 
process should consist, to the extent practical, of service-degraded tube specimens (i.e., specimens 
removed from operating steam generators), supplemented, as necessary, by tube specimens con¬ 
taining flaws fabricated using alternative methods provided that the nondestructive examination 
parameter responses from these flaws are fully consistent with actual in-service degradation of 
the same flaw geometry. 

^Proposed NRC Generic Letter, "Steam Generatur Tube Inspection Techniques," SECY-97-280 ,December 3, 1997. 
NRC Generic Letter 97-05, "Steam Generatur Tube Inspection Techniques," was subsequently issued December 17 
1997. 
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8.3 Currently Used Component — Westinghouse Model F Steam Gen¬ 
erator 

The candidate PWR uses Westinghouse Model F steam generators with 5626 Thermally Treated 
Inconel 600 U-tubes (SB-163) that are hydravdically expanded into the tubesheet at each end. The 
current NRC inspection guidelines for steam generators allow for periods between steam genera¬ 
tor eddy current testing of up to 40 months. This interval is allowed only after two previous suc¬ 
cessful inspections at shorter intervals. However, rather than accomodate a changing inspection 
interval in maintenance planning most PWRs inspect all their steam generators every refueling 
outage regardless of the maximum permitted inspection interval. This has resulted in a signifi¬ 
cant amount of data on steam generator tubing performance collected for 18-24 month operating 
intervals but little for longer intervals. 

8.4 IRIS Steam Generator Design and Inspection 

The maintenance related barriers associated with currently used steam generators are appli¬ 
cable to the IRIS steam generator design but one fundamental operational difference exists. In 
a conventional steam generator, the higher reactor coolant pressure is on the inside of the steam 
generator tubing. Although an integral pressurized water reactor could be configured to have the 
pressure on the inside of the tubing also, the IRIS steam generators will have the reactor coolant 
pass over the tubing rather than inside of it. This configuration was selected because it reduces 
pressure losses in the reactor coolant loop and enhances natural circulation flow, which is a key 
characteristic in the IRIS accident mitigation scheme. 

Regardless of whether the tubes are in tension (with the higher pressure on the inside of the 
tubing) or compression (as in the IRIS design), the requirement to inspect the steam generator 
tubing does not change. This reversal of differential pressure compared to current steam genera¬ 
tors, however, makes it more difficult to design the steam generators to be accessible for inspection 
since the inspection method is not necessarily known. Efforts are currently imderway by the IRIS 
team to identify the dominant failure mechanism for tubes in compression (vice tension, which 
are currently inspected using eddy current techniques) and the applicable inspection technique to 



detect this failure mechanism. 

Rather than delay the steam generator development, it is assumed that whatever inspection 
method is to be utilized will use equipment and techniques similar to eddy current testing (i.e., 
an active element on a cable which is inserted into the tube). For the proposed solutions to the 
accessibility design problem, constraints are carried over to the inspection technique development 
problem. There is a risk in this approach that the equipment to perform the applicable inspection 
technique is not (as assumed) similar to eddy current testing. However it is possible that eddy 
current testing may turn out to be the applicable inspection technique for IRIS steam generators. 
And if it is not, advances in miniaturizing electronic components suggest that the equipment 
to perform the applicable technique is likely to be at least not larger than current eddy current 
inspection equipment. 

The ultimate selection of steam generator tube configuration (modular helical-coil or u-tube) 
will have little impact on the accessibility design problem (although it will significantly impact 
the inspection method). All proposed configurations will have channel heads with the tubes pen¬ 
etrating the heads, similar to the conceptual c-tube design of Figure 8-2. In currently used steam 
generators, such as the Westinghouse Model F above, the tubes are hydraulically expanded into 
the tubesheet and a pressure tight seal is created when the tubes are internally pressurized. For 
IRIS, the tubes will tend to contract when externally pressurized which could lead to leakage be¬ 
tween the tubes and channel head. Two methods will be utilized to mitigate this potential leakage: 
(1) a collar will be pressed into each tube, which will maintain the tube pressed against the channel 
head, and (2) the tubes will be seal welded to the channel head. The once-through configuration of 
the IRIS steam generators requires the flow to be balanced across the tube bundle within a steam 
generator, so the tube collar will also function as an orificing device. The implication of these ori- 
ficing devices is that a large active element may be difficult (or impossible) to insert into the tube, 
necessitating partial steam generator disassembly or complete removal for inspection. 

8.5 The Steam Generator Tube Inspection Maintenance Barrier 

Failure of any given steam generator tube is not an inevitable occurance, nor is failure of a 
single tube a catastrophic event. However, in current design steam generators failure of a steam 
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Top View 


From R/V Inside View 


Figure 8-2: Conceptual Drawing of IRIS C-Tube Steam Generator 

generator tube does compromise the RCPB and can lead to a significant loss of primary coolant 
and contamination of the steam system if not immediately detected. Therefore, steam generator 
tube failure must be prevented for both safety and investment protection reasons. Currently, steam 
generator tube failure is prevented by detecting and eliminating conditions which are known to 
potentially lead to tube failure. 

For IRIS, meeting the operating cycle length goal requires one of the following conditions: 

• Eliminating the conditions which potentially lead to tube failure allowing the inspection 
interval to be extended to a periodicity consistant with the operating cycle length, 

• Eliminating the use of the steam generator tubes as a reactor coolant pressure boundary 
eliminating the requirement to conduct tube inspections, or 

• Making the tube bundle accessible for inspection at power. 

At this early stage of IRIS development, it is not reasonable to assiune that the conditions 
which potentially lead to tube failure can be eliminated since they have not yet been identified. 
The second option, moving the reactor coolant pressure boimdary, is also not feasible since it 
would make portions of the steam and feed systems (from the steam generators to the main steam 

















































isolation valves and feedwater isolation valves) part of the RCPB and these components would 
need to be designed to the higher reactor coolant system pressure and tested as an active safety 
system. Designing a complex system to accomodate failure of a component is certainly prudent, 
but accomodating the failure simply because the designer chooses not to take adequate and rea¬ 
sonable steps (such as periodic inspections) to prevent the failure circumvents the intent of the 
regulations to ensure mechanical integrity of the RCPB. Therefore, resolving the steam generator 
tube inspection maintenance barrier requires development of a means to perform the required 
inspections at power. 

8.6 Application of the Design Resolution Methodology 

8.6.1 Currently Used Component 

The currently used steam generator does not meet the functional requirement for a compact 
internal steam generator. Based on the significant design differences between currently operating 
PWRs and IRIS, no component modifications can be made which will make a design like the 
Westinghouse Model F suitable for use in IRIS. However, analysis of the Model F is not without 
benefit since much of the maintenance performed on the Model F will also be performed on the 
IRIS steam generators. 

8.6.2 Isolating Steam Generators for Inspection 

Section 11.3, 'IRIS Integrated Testing and Coordinated Maintenance,' describes a comprehen¬ 
sive inspection scheme to perform required maintenance with the steam generator isolated but the 
reactor still at power. For this steam generator inspection to be conducted, consideration must be 
given to the extremes of temperature and radiation present inside the steam generator (for equip¬ 
ment) and in the vicinity of the reactor vessel (for personnel). Therefore, the inspection equipment 
must remotely operated with the following characteristics: 

• The inspection equipment must be flexible enough to make up to a 180-degree bend and be 
directed into the desired tube, yet rigid enough to be pushed through all turns (including the 
multiple turns of a helical-coil steam generator). To transit the entry path and through the 



tube may require an additional force (such as flow, which would result in the generation of 
steam). To find the desired tube implies an imaging capability, although physically marking 
the tubes at the entrance (such as unique etched bands) would allow tube identification after 
inserting the active element. 

• Current eddy current inspection equipment requires small tolerances between the coil and 
the tube wall for sensitivity and accuracy. The inspection method must be such that active 
element (probe, coil, transducer, etc.) is small enough to fit into the flow orificing device yet 
still maintain directional detection accrtracy. 

• The inspection device must be able to be removed for inspection and calibration. This is most 
feasibly accomplished by inserting the inspection equipment into the line used to drain the 
steam generator after conducting the integrated safety test. However the inspection equip¬ 
ment penetration into the feedwater system must be pressure tight to provide personnel 
protection and prevent primary coolant loss in the unlikely event of tube failure during in¬ 
spection. 

8.6.3 Continuous On-Line Inspection 

A potential use of the method described above for isolated steam generator inspection is as a 
continuous on-line method. Rather than guiding the active element into a particular tube, normal 
feedwater flow could be used to force the active element into a random tube (which will be posi¬ 
tively identified by the active element) as the inspection equipment control cable is let out. If the 
channel head entrance is sufiiciently turbulent, then every tube will have a non-zero probability 
that the active element will enter that specific tube. Therefore, the inspection rate must be high 
enough to ensure a high statistical likelihood of all tubes being inspected during a specified in¬ 
terval. If all tubes are not inspected during the interval, then an assessment must be made based 
on the number of inspections made and the number of tubes inspected whether a representative 
sample has been collected to ensure the reliability of all tubes in that generator. 



8.6.4 ^Intelligent' Inspection Methods 


Early research is being conducted on 'intelligent' inspection methods which use microminia¬ 
ture electronics in a small probe which travels in the fluid stream. The probe is inserted into the 
system and gathers data as it traverses the system to the exit point. For steam generator tube 
inspection, the probe would need to be small enough to be entrained by the flowing steam and 
carried to an exit point in the main steam header. At this point, the probes imder development 
cannot localize detected flaws and thus provides only an indication that a flaw exists somewhere 
in the (unknown) flow path. 


8.7 Summary 

This chapter has addressed the steam generator tube integrity inspection barrier, and a sum¬ 
mary of design solution alternatives is presented in Table 8.1. Although more steam generator 
design definition is required to fully analyze this barrier, steam generator tube integrity inspec¬ 
tion will be the greatest challenge to achieving the target operating cycle length. Fundamentally, a 
satisfactory solution will not be developed without a significant technology investment that iden¬ 
tifies and develops a novel technique for performing the required inspections. 


Table 8.1: Steam Generator Tube Inspection Alternatives Summary 




Maintain- 

Anticipated 

Technology 

Alternative 

i Siictipn 

ability 

Cost 


Isolated Steam Generator Inspection 

8.6.2 

medium 

medium 

medium 

Continuous On-line Inspection 

8.6.3 

medium 

medium 

medium 

Traveling Probe Inspection 

8.6.4 

high 

high 

high 
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Chapter 9 

Application of Resolution 
Methodology-Main Condenser 

9.1 Introduction 

The main condenser is the primary heat sink for the power plant, and the ability to effectively 
transfer heat to the main condenser is vital to the efficient performance of the entire plant. If 
the main condenser heat transfer capability is degraded, the plant must be either operated at 
lower power (to maintain condenser operating conditions) or risk overheating. At it's extreme, 
overheating can lead to potentially severe condenser shell damage such as overpressurization 
and rupture. 

The primary contributors to main condenser heat transfer degradation are clogging and foul¬ 
ing of the inlet tube sheets and tubes from: 

• biofouling (organic debris that adheres to the inside diameter of the tube surface or blocks 
the intake flow at the tubesheet), 

• slime/algae (bacteria that adheres to the condenser tube surface and reduces the usable tube 
surface area and cooling water flow area while aggravating and accelerating corrosion, ero¬ 
sion and pitting of the condenser tubes), 

• barnacles/mussels/clams (small marine creatures which block cooling water flow at the 
tubesheet and/or adhere to the inner diameter of the tube surface which increases flow 



velocity and accelerates tube erosion), 

• lodged foreign material (which causes flow deflection leading to localized pitting and ero¬ 
sion), and 

• scale (a hard deposit that adheres to the condenser tube surface which reduces heat transfer, 
decreases plant performance, and causes pitting of the condenser tubes). 

All tube fouling will increase flow velocity, reduce heat transfer, increase back pressure and de¬ 
crease efficiency of the condenser. 

9.2 Main Condenser Cleaning and Inspection Barrier 

Current nuclear power plants were typically outfitted with shell and straight-tube (copper) 
condensers with two or three waterboxes. At that time, due to the relatively short fuel cycle, it 
was anticipated that although fouling would occur it would not result in significant degradation 
of the overall plant thermal efficiency. Operating experience revealed this assumption to be overly 
optimistic. Plants experienced significant reductions in thermal efficiency (especially those using 
silted brackish water) as well as accelerated corrosion leading to tube leaks. 

As a result of the early condenser experiences many plants have changed (or plan to change) 
their condenser tubes to titanium, which is much less susceptible to corrosion. To control fouling a 
number of strategies have been employed to chemically treat and/or mechanically filter the inlet 
cooling water. The extent to which a given plant employs these methods depends strongly on 
the economic balance between capital investment in the systems and the ability of the systems 
to maintain (or slow the reduction of) plant overall thermal efficiency. In some cases, excessive 
fouling cannot be prevented for an entire operating cycle and a mid-cycle reduced power window 
is required to sequentially clean the waterboxes. 

Even with the IRIS mid-cycle maintenance shutdown strategy (at the 48 month point), a means 
to clean the main condenser waterboxes during the cycle must be provided. Design strategies 
which enable main condenser waterbox cleaning are discussed below. 
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9.3 Application of the Design Resolution Methodology 


Evaluation of the IRIS requirements and main condenser operating history using the method¬ 
ology of Chapter 5 leads to the conclusion that advances in condenser materials will not allow for 
extended operating cycles without significant fouling, and so a means to clean the main condenser 
tubes at power must be developed. Design solution alternatives which meet the requirements are 
described below. 

9.3.1 On-Line Cleaning Enabled by Multiple Waterboxes 

Access to the condenser tubes during condenser operation can be readily enabled by utiliz¬ 
ing multiple (independently isolable) waterboxes. The strategy requires using n waterboxes, each 
with enough heat removal capability such that only n-1 waterboxes are required to remove the 
maximum plant heat load at the least efficient condenser conditions. These conditions are cal¬ 
culated assuming maximum tube fouling for all on-service waterboxes, worst case cooling water 
conditions (maximum inlet temperature, minimum flowrate), all auxiliary steam loads secured, 
and maximum plant thermal power (including instrumentation uncertainties). The net effect of 
these assumed conditions is to have maximum condenser heat input under worst-case heat re¬ 
moval conditions. 

Although this method will enable access for tube cleaning, it suffers from two significant draw¬ 
backs: cleaning is man-intensive and increasing the number of waterboxes increases condenser 
complexity (leading to increased capital cost). The condenser is a large component which is fab¬ 
ricated and assembled from a large number of metal parts, and is a small but significant portion 
(typically on the order of 2-3%) of the total capital investment. A detailed analysis is necessary 
to find the optimal economic point which balances the number of waterboxes against the amount 
of installed over-capacity per waterbox. General discussions conducted with a condenser manu¬ 
facturer indicated that the optimal number of waterboxes is on the order of ten (each with 10% 
over-capacity). 
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9.3.2 On-Line Cleaning 

Improved on-line cleaning methods have emerged in recent years which are effective in reduc- 
ing fouling to the point where a through off-line mechanical cleaning is required only infrequently 
(on the order of ten years). Two metirods dominate the on-line cleaning market, brush-type and 
ball-t)q)e.^ Both methods pass an abrasive device through the condenser tubes, using the differ¬ 
ential pressure across the waterbox to move ihe device. However, although both methods are 
generally effective enough to prevent heat transfer degradation the entire tube circumference may 
not be throughly cleaned. This streaking inside the tube can result in conditions conducive to 
galvamc corrosion, although titanium tubes are much less susceptible. 

9.3.2.1 Brush-Type On-Line Condenser Cleaning System 

In the brush-type method (Figure 9-1) a brush is inserted into each condenser tube. A perfo¬ 
rated basket is attached to the end of each condenser tube which prevents the brush from leaving 
the tube and entering the inlet or outlet waterbox head. A diverter valve is installed between 
the tubeside piping to and from the unit, and is used to reverse flow direction through waterbox 
causing the brushes to travel from one basket (through the tube) to the other basket. Figure 9-l(a) 
shows the flow diverter in the standby normal flow position. With flow in the normal direction, 
the brushes rest in their "home" baskets. The flow diverter is shown in the reverse flow position in 
Figure 9-l(b). The brushes are carried through the tubes, cleaning as they pass through the tubes. 
The brushes are caught by the "temporary" catch baskets at the opposite ends of the tubes and 
held there for a brief period. When the flow diverter is brought back to the normal flow position, 
the brushes are carried back through the tubes to their "home" positions where they wait until the 
next cleaning cycle is initiated. After sufficient time delay, the diverter valve reverses the flow di¬ 
rection through the waterbox causing the brush to again travel the length of the tube. This process 
is repeated until the waterbox thermal performance is restored. 

There are several manufacturers of both brush-type and ball-type condenser tube cleaning systems. The figures 
and descriptions here are for systems manufactured by WSA Engineered Systems, Milwaukee, WI. 



(a) Standby Position 



(b) Reverse Flow Position 


Figure 9-1: Brush-Type On-Line Condenser Cleaning System Flowpath 





Figure 9-2: Ball-Type On-Line Condenser Cleaning System Operation. Abrasive balls are pumped 
from the collection vessel to the injector, where they enter the condenser waterbox inlet head. 
After passing through a random tube, the balls are captured by the strainer and directed (via the 
recirculation pump) to the collection vessel. 


93.2.2 Ball-Type On-Line Condenser Cleaning System 

The ball-type method (Figure 9-2) uses a large number of abrasive balls which are introduced # 

into the inlet cooling water stream, pass through the condenser tubes, and are recovered from 
the outlet cooling water stream. Unlike the brush-type method (where one brush is uniquely 
associated with one tube) this method does not ensure that a cleaning ball will (even after several 
passes) travel through any individual tube. ^ 
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9.4 Summary 


This chapter has presented several alternatives for consideration in the IRIS design. The first 
alternative is simply an extension of current design practice to make waterboxes isolable and 
accessible. The two on-line methods described use an abrasive object (brush or ball) which cleans 
the condenser tube as it passes through. 

Table 9.1 summarizes the alternatives qualitatively ranked by maintainability, economic via¬ 
bility, and technology risk. Within the alternatives generated, installation of n-1 waterbox redun¬ 
dancy presents essentially no technology risk since it is a simple extension of today's technology. 
However, without an economic assessment of the cost impact of fiie additional waterboxes, valves, 
and associated piping a recommendation of the best alternative to pursue cannot be made. 


Table 9.1: Main Condenser Cleaning Alternatives Summary 



Report 

Section 

Maintaih- 
ability -.'I' 

Anticipated? 

Cost 

Technology 

:-jRisk, ;>v' 

n-1 Waterbox Redundancy 

9.3.1 

medium 

unknown 

very low 

Brush-Type On-Line Condenser Clean¬ 
ing System 

9.3.2.1 

high 

medium 

medium 

Ball-Type On-Line Condenser Clean¬ 
ing System 

9.3.2.2 

medium 

medium 

medium 








Chapter 10 


Application of Resolution 
Methodology-Turbine Generator 
Throttle Control 

10.1 Introduction 

The main turbine generator is a multi-stage steam driven turbine coupled directly to a large 
three phase generator. Current turbine generators use an electro-hydraulic control (EHC) system 
to position hydraulically-actuated throttle valves which control steam flow to the turbine. Once 
synchronized to the grid, the turbine generator rotates at constant speed and steam flow controls 
the amount of power sent to the grid. Nuclear generation is typically used for baseline loading, 
and little throttle valve movement is necessary for long periods once the plant is at maximum 
power. When throttle valve movement is required, electric signals are sent to electrically-actuated 
control valves which reposition and allow the system hydraulic fluid to operate on the throttle 
valves. 

10.2 Main Turbine Generator Maintenance Barrier 

When the turbine generator is synchronized to the grid and producing constant (maximum) 
power, little hydraulic fluid flows through the EHC system. As a result, impurities and wear 
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products (sludge) in the hydraulic fluid collect in low flow regions. These regions typically are 
in the immediate vicinity of the electrically-actuated control valves, and often lead to sluggish 
control valve actuation. 

When this sluggish actuation occurs, the EHC system does not respond as expected and the 
turbine generator throttle valve tends to cycle about the desired operating point. This leads to a 
plant power output to the grid which oscillates about the mean (maximum) power point. If al¬ 
lowed to grow, the oscillation peak can lead to generator overheating and potential stator damage. 

Operating experience with current EHC systems shows that the system operates reliably for 
the current operating cycle length (on the order of 24 months), but that sludge deposits do form. 
Extrapolating this performance data to longer operating cycles indicates that reliable operation 
cannot be ensured. 

10.3 Application of the Design Resolution Methodology 

Evaluation of the IRIS requirements and main turbine generator EHC system operating his¬ 
tory using the methodology of Chapter 5 leads to the conclusion that advances in the throttle 
control system to prevent sludge buildup in low hydraulic fluid flow regions must be developed. 
Potential design solution alternatives which support development of an advanced EHC system 
are described below. 

10.3.1 Prevention of Sludge Buildup 

The root cause of the EHC system reliability issue is inadequate hydraulic fluid flow through 
the EHC system. In other low hydraulic flow applications, this problem is solved by sending 
dithering signals in a programmed sequence to the control valves causing them to stroke and 
disturb the low flow regions. If sufficient control valves exist in the system (which is the case for a 
modem turbine generator EHC system) then these dithering signals move only a small amount of 
hydraulic fluid from control valve to control valve and do not result in motion of the hydraulically- 
actuated component. Although 'as-built' turbine generators did not have this feature, dithering 
systems are finding increasing application in turbine generator control systems for both baseline 
and load following applications. 




Another technique which addresses the low hydraulic fluid flow problem is the use of ultra¬ 
sonic transducers to agitate the hydraulic fluid at high frequency to prevent sludge from settling. 
Unlike the dithering technique which surges hydraulic fluid from one control valve to the next, 
this method simply keeps the sludge suspended in the fluid allowing it to move through the sys¬ 
tem when the control valves are actuated. 

Finally, synthetic oils typically contain much less impurities than do petroleum fluids and have 
(or can be formulated to have) similar properties. Synthetic oil types include polyalphaolefins, 
diesters, polyol esters, alkylbertzenes, polyalkylene glycols, phosphate esters, silicones, and halo- 
genated hydrocarbons. Synthetic oils are generally organic compoxmds and cost much more than 
petroleum oils. However, each type has one (or more) specific properties that are better than 
petroleum oils, and the limitations can generally be corrected by chemical additives. For IRIS, 
a detailed analysis of the EHC system characteristics must be made to match the synthetic oil 
properties to the application. 

10.3.2 Electric Control System 

A control system which uses electric linear motors to position the throttle valves would not be 
subject to the stability problems experienced by an EHC system. However, there is no industry 
impetus or manufacturer initiatives to improve the current technology EHC system (since it is 
generally reliable throughout the current operating cycle). Therefore, a significant research and 
development expenditure would be necessary to make an electric control system commercially 
viable. 

10.4 Summary 

In procuring a main turbine generator, performance specifications are typically given to the 
manufacturer and then the manufacturer uses it's own technologies to meet those specifications. 
Reactor plant designers rarely are involved directly in the main turbine generator design. The 
IRIS design team intends to be indirectly involved in the main turbine generator design process, 
funding research initiatives where necessary and applicable. Directly designing a main turbine 
generator system (including throttle control system) does not adequately leverage the design ex- 
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perience of the manufacturer and involves significant technology and economic risk. 

It is likely that integrating available current technologies into the EHC system is more cost 
effective than development of an advanced technology control system. Only operating experience 
with this improved system will determine if this solution meets the long-term IRIS target cycle 
length goal of eight years, but it is anticipated that this improved EHC system will operate reliably 
for at least four (and possible to eight) years. This 'operate and assess' strategy has been adopted 
by the IRIS design team to maximize the potential for success while mi nimizin g risk. 
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Chapter 11 


Application of Resolution 
Methodology-Reduced Power Window 
Surveillances 

11.1 Introduction 

There are a large number of investment protection based surveillances (67 total) which are cur¬ 
rently performed off-line but could be performed on-line at reduced power. Most of these surveil¬ 
lances have performance intervals much less than 48 months (tj^ically 18 months) and therefore 
can also be considered to be barriers to a 48 month (full power) operating cycle. These surveil¬ 
lances have been generalized into six broad categories, and their resolution in IRIS is described 
below. 

11.2 Resolution of Reduced Power Window Surveillances 

11.2.1 Circulating Water/Service Water Pump and Traveling Screen Inspections 

To conduct the required pump and traveling screen inspections requires one traveling screen- 
pump-heat exchanger train to be secured and drained. At the candidate PWR there are three 
identical parallel trains, each capable of removing approximately 46% of the maximum heat load. 


123 



Therefore, when one train is secured for inspection the total plant power (which is proportional 
to heat load) is limited to approximately 92%. In IRIS, additional train heat removal capacity or 
additional redtmdancy will be utilized to allow these surveillances to be conducted on-line with 
no power restrictions. 

11.2.2 Generator Stator Cooling 

Current main turbine generator sets use two identical cooling loops to cool the generator stator, 
both of which must be on-line for full power operation. As above, this limitation can be readily 
solved in IRIS using by adding redundancy to allow one cooling loop to be removed from service 
with no power restrictions. 

11.2.3 Main Turbine Lube Oil System Pressure Switch Calibrations 

These surveillances can be performed on-line with adequate installed redundancy. Installa¬ 
tion of one additional pressure switch would maintain the original number of required on-service 
switches while allowing one to be removed from service for testing or repair. To avoid an in¬ 
advertent turbine generator trip, a digital trip control system will need to be developed but the 
technology required is foimded in current practices. 

11.2.4 Nuclear Instrument Calibration 

Calibration of the power range nuclear instruments cannot be conducted without a change in 
power level since a single data point cannot establish the required instrument gain setting (i.e., 
the slope of the calibration curve). The current calibration method requires steady power to be 
maintained at a low level (approximately 20% reactor power) for data collection and then at high 
(near maximum) power. New techniques are being developed^ which use automatic data collec¬ 
tion from in-core flux monitors and require only a small reduction in reactor power (without a 
change in steam flow). This technology is anticipated to be available in 1-3 years. 

’"An In-Core Power Deposition and Fuel Thermal Environmental Monitor for Long-Lived Reactor Cores," U.S. De¬ 
partment of Energy Nuclear Energy Research Initiative, Proposal No.: 2000-069, awarded to Ohio State University 



11.2.5 Main Steam Isolation Valve Maintenance 


Main steam isolation valve stroke check and actuating system surveillances will be conducted 
as part of the integrated passive safety systems operability testing described in Section 11.3 below. 

11.2.6 Feedwater System Inspections and Calibrations 

These surveillances will be conducted as part of the integrated passive safety systems oper¬ 
ability testing described in Section 11.3 below. 

11.3 IRIS Integrated Testing and Coordinated Maintenance 

Based on the AP600 proof of operability burden, it is anticipated that demonstrating operabil¬ 
ity of the IRIS passive cooling scheme will require initiation of cooling and measurement of both 
cooling loop flowrate and heat transferred to the heat sink. Although the flowrate and heat trans¬ 
fer can be determined a priori for the (at power) primary coolant circuit conditions, proper flow 
conditions in the passive cooling loop will not be established without steam and feed flow being 
secured. Therefore, this operability test could be conducted with the reactor at power but with the 
steam and feed headers for the passive cooling loop secured. This corresponds to 75% total steam 
flow (three-fourths of all installed steam generators operating) for testing. 

The integrated test begins with isolation of steam and feed flow for the header being tested, 
followed by initiation of passive cooling flow, and ends with measurement of the parameters nec¬ 
essary to demonstrate operability. After conducting the operability test, the passive cooling system 
is then drained to allow for in-situ steam generator tube inspections (if these inspections cannot 
be deferred to a maintenance outage). Finally, necessary maintenance on the main steam isola¬ 
tion and feedwater isolation valves is performed. After completion of maintenance and before 
restoring normal operation, feedwater regulating valve maintenance and feed pump maintenance 
is conducted as well as the containment safety features response time testing of Chapter 6, Sec¬ 
tion 6.2.1.2. It is estimated that this entire maintenance block can be completed, for one passive 
cooling circuit, in one week. 

Also to be considered is reactivity control testing which may need to be conducted. Oper¬ 
ation within the reactor safety analysis assumptions regarding rod control system performance 





cannot be assured for eight years of continuous operation without demonstration of the normal 
and emergency reactor shutdown mechanism. The IRIS team is currently examining different re¬ 
activity control and reactor shutdown methods, so it is not possible at this point to identify likely 
testing requirements. What can be assumed, however, is the core design must allow for at-power 
testing of the reactor shutdown mechanisms if a mid-cycle reactor shutdown is to be avoided. 

From the above testing profile, it is estimated that IRIS will enter a two week 75% power 
window every two years (testing two passive cooling loops sequentially during each reduced 
power outage). Therefore, IRIS will operate 75% power for two weeks every two years or six 
weeks over the entire eight-year fuel cycle. The fourth testing and maintenance period would be 
scheduled to coincide with the refueling outage. Including a one-month refueling outage over the 
96 week fuel cycle, the conservatively estimated theoretical imit capability factor is 98.4%. 

11.4 Reduced Power Surveillance Strategy 

It is unlikely that design solutions for all barriers with periodicities less than eight years can 
be found to allow maintenance to be performed on-line without power restriction. Although this 
thesis has attempted to assist in developing design solutions which enable this condition, surveil¬ 
lances have been identified (specifically, safety system operability demonstration and steam gen¬ 
erator tube integrity inspections) which cannot feasibly be performed on-line without a very sig¬ 
nificant technology development effort. Therefore, given that a reduced power window will be 
required a strategy that considers capital investment, investment protection requirements, and 
availability should be developed. 

For example, the design solution which allows performing circulating and service water sys¬ 
tem maintenance (Subsection 11.2.1, above) is installation of redundancy. However, if this main¬ 
tenance were scheduled for completion during a reduced power window then the capital invest¬ 
ment for an additional cooling train can be avoided without impacting overall plant availability. 
This analysis is beyond the scope of this thesis, but is described here since it contributes to an 
overall soimd design strategy. 
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11.5 Summary 


Design solutions to the most significant of the identified maintenance barriers requiring re¬ 
duced power have been proposed, with the notable exception of safety system operability testing. 
Therefore, given that a reduced power window is required in IRIS, a strategy which minimizes 
the duration of this window has been proposed. This strategy meets the current regulatory re¬ 
quirements for operability demonstration without significant regulatory changes or technological 
advances. 

It must be recognized that a balanced economic strategy does not always justify the required 
investment to eliminate reduced power windows. Development of materials and technologies 
to eliminate currently unresolvable reduced power surveillances potentially requires a large re¬ 
search and development investment and delay in fielding such solutions. Also, the capital cost of 
solutions which require the installation of additional capacity or redundancy may not be justified 
relative the the reduction in availability from performing maintenance of lower capacity systems 
during a reduced power window. 



128 




Chapter 12 


Summary and Future Work 


12.1 Summary 

A renewed interest in new nuclear power generation in the United States has spurred interest 
in developing advanced reactors with features which will address the public's concerns regarding 
nuclear generation. However, it is economic performance which will dictate whether any new 
orders for these plants will materialize in the next decade. Economic performance is, to a great 
extent, improved by maximizing the time that the plant is on-line generating electricity relative 
to the time spent off-line conducting maintenance and refueling. Indeed, the strategy for the 
advanced light water reactor plant IRIS (International Reactor, Innovative & Secure) is to utilize 
an eight year operating cycle. 

A formalized strategy to address, during the design phase, the maintenance-related barriers to 
an extended operating cycle does not exist. Therefore, the top-level objective of this thesis was to 
develop a methodology for injecting component and system maintainability issues into the reactor 
plant design process to overcome these barriers. 

A primary goal was to demonstrate the applicability and utility of the methodology in the 
context of the IRIS design. The methodology developed has been demonstrated to narrow the 
design space to feasible design solutions which enable a desired operating cycle length, yet is 
general enough to have broad applicability. Feedback from the IRIS design team indicates that 
the proposed solutions to the investigated operating cycle length barriers are both feasible and 
consistent with sound design practice. 
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12.1.1 Methodology Development 


The first step in meeting the top-level objective was to determine the t)^es of operating cycle 
length barriers that the IRIS team is likely to face. An investigation into the regulatory and in¬ 
vestment protection surveillance program barriers preventing a candidate operating PWR from 
achieving an extended (48 month) cycle has been recently completed.^ This presented a logical 
starting point, and the results of the operating PWR investigation were examined in the context 
of the IRIS design. Relative to IRIS, the surveillances were generalized and placed into one of the 
following categories: 

Category 1: On-line surveillances which will be performed on-line in IRIS; 

Category 2: Candidate surveillances for design resolution to create an on-line performance 
mode in IRIS; 

Category 3: Surveillances requiring further analysis to determine performance mode in IRIS; 
and. 

Category 4: Off-line surveillances likely to have performance interval extended to at least 
eight years in IRIS. 

The design methodology was developed to address those surveillances in Category 2. 

The operating PWR investigation addressed a 48 month operating cycle, but the IRIS op¬ 
erating cycle length goal is eight years. Therefore, the 54 surveillances resolved to Category 2 
represent a minimum number of potential IRIS operating cycle length barriers. It is likely that 
additional unidentified barriers exist which were already compatible with the 48 month operating 
PWR cycle length (i.e., performance periodicities already greater than 48 months) but may be a 
barrier to an eight year operating cycle. However, this thesis did not investigate surveillances with 
a periodicity greater than 48 months. But, since the 54 known barriers cover a broad spectrum of 
systems and components they were considered representative of the design challenges likely to 
be presented by the unidentified barriers. 

'Moore Jr., Thomas Joseph, "A Surveillance Strategy for a Four Year Operating Cycle in Commercial Pressurized 
Water Reactors,” Massachusetts Institute of Technology Department of Nuclear Engineering, Nuclear Engineer's The¬ 
sis, May 1996. 
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The design methodology developed is a four-step process. The first step is the synthesis of 
the general requirements that the component must satisfy. The second step is the synthesis of the 
design objectives with the design requirements. The third step is to bound the solution space by 
application of suitable and relevant constraints. The final step is to develop design alternatives 
which meet the specifications of the synthesized design requirements, objectives, and constraints. 
Like any design process, the methodology flowchart is iterative in nature. 

12.1.2 Methodology Application 

The methodology was applied to the identified (Category 2) operating cycle length barriers. 
Many of the barriers were considered (based on discussions with the IRIS design team) to be 
readily solved by design, and so a detailed investigation into these barriers was not conducted. 
However, several IRIS operating cycle length barriers emerged which required further investiga¬ 
tion: 

• Primary relief valve testing, 

• Steam generator eddy current inspection, 

• Condenser waterbox maintenance, 

• Main turbine throttle control maintenance, 

• Safety system testing, 

• Reduce power window items, and 

• Reactivity control system testing. 

Detailed design of the IRIS core has not been completed, and so reactivity control system 
testing could not be addressed in this thesis. The resolution methodology was applied to the 
remaining barriers and feasible (as assessed by the IRIS design team) design alternatives were 
proposed which enable achievement of the eight year IRIS operating cycle length goal. 
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12.1.3 Resolution Methodology Limitations 


The resolution methodology developed and applied in this thesis is not intended to eliminate 
the need for creative thought in the design process. This point cannot be emphasized enough, 
since it is the creative element that allows any design to be a significant improvement over the 
current standard. Although the results presented in this thesis for overcoming operating cycle 
length barriers are the produce of a structured methodology, they cannot be reproduced without 
including the creative design element. What can be reproduced, however, is the synthesis of rel¬ 
evant factors into a limited set of governing constraints which guide that creative process toward 
feasible solutions which meet the specified requirements. 

12.2 Future Work 

This thesis is the first attempt at developing a structured methodology to address maintenance- 
related barriers to an extended operating cycle. As with any methodology, refinement and im¬ 
provement to the methodology can be made by identifying limitations in it's applicability. Al¬ 
though feasible solutions were generated which will assist the IRIS design team in achieving the 
target operating cycle length goal of eight years, there is a significant amount of future work that 
must be completed to improve the utility of this methodology as discussed below. 

Chapter 2, 'Design Methodology Framework,' discussed the methodology inputs necessary to 
develop feasible design solution alternatives. These inputs were developed with the prior knowl¬ 
edge of the barriers requiring design resolution. Additional investigation into the creative design 
process needs to be conducted to ensure that all relevant factors have been adequately captured. If 
additional factors exist, then the methodology of Chapter 5, 'Eliminating the Maintenance-Related 
Barriers,' needs to be updated to include them. 

Chapter 3, 'Operating Pressurized Water Reactor Surveillance Program,' presented the results 
of an investigation which considered only those surveillances which have periodicities less than 48 
months. The identified barriers from the candidate operating PWR investigation were considered 
to be representative of the types of barriers likely to emerge from the unexamined (greater than or 
equal to 48 month timeframe) surveillances. Further examination of this timeframe is required to 
validate the assumption that the spectrum of potential barriers has been bounded. 
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Chapters 6 through 11 presented design solution alternatives to identified IRIS operating cycle 
length barriers. As the IRIS design matures, these solutions need to be continuously evaluated 
against the IRIS design requirements, objectives, and constraints to ensure that the proposed so¬ 
lutions remain feasible. 

The resolution methodology is structured to generate design solution alternatives which en¬ 
able performing all maintenance on-line at full power. Some barriers have been identified which 
either require a significant research and development expenditure or must be performed during 
a reduced power window. It would be useful to examine the economic dependence between lost 
revenue in reduced power windows and capital expenditure to eliminate those windows to de¬ 
velop a more balanced (economically driven) design strategy. 

Finally, the operating cycle length barriers considered in this thesis were well defined and a 
large amoimt of supporting data was available (since these barriers were not IRIS unique) to assist 
in resolution. As the IRIS design matures, IRIS vmique operating cycle length barriers not faced 
by currently operating plants will certainly emerge. Application of the resolution methodology to 
these barriers will challenge the fundamental structure of the methodology more thoroughly than 
has been done in this thesis. 
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Appendix A 


Identified IRIS Maintenance Barriers 


This appendix summarizes the maintenance-related barriers described in Chapter 3, 'Operat¬ 
ing Pressurized Water Reactor Surveillance Program/ Table A.l addresses the barriers to a four 
year operating cycle. Table A.l addresses the reduced power window items, and Table A.3 ad¬ 
dresses the barriers to an eight year operating cycle. 
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Table A.l: Identified Maintenance Barriers to Four-Year Op¬ 
erating Cycle 


Description 


Distussion 


Basis 


Installation of ASME Class 1 
relief valves (including pres- 
surizer relief valves and steam 
generator/main steam safety 
valves). 


Periodic testing of ASME 
Class 1 relief valves (including 
pressurizer relief valves and 
steam generator/main steam 
safety valves). 


The ASME Boiler & Pressure 
Vessel Code primarily deals 
with relief valve construction, 
with limited discussion of in¬ 
stallation requirements. Within 
the Code, installation of an 
inlet isolation valve is per¬ 
mitted under certain (inade¬ 
quately specified) conditions. 
IRIS requires a relief valve in¬ 
let isolation valve to conduct in 
situ (but off-service) valve test¬ 
ing. 

All valves of each type and 
manufacture shall be tested 
within each subsequent^ 5 year 
period with a minimum of 20% 
of the valves tested within any 
24 months. This 20% shall be 
previously xmtested valves, if 
they exist. 


ASME Boiler & Pressure Ves¬ 
sel Code, Section HI, 'Nuclear 
Power Plant Components,' Ar¬ 
ticle NB-7000, 'Overpressure 
Protection.' 


'The Operation and Main¬ 
tenance of Nuclear Power 
Plants,' ASME/ANSI OM- 
1989^, Part 1, 'Requirements 
for Inservice Performance 
Testing of Nuclear Power 
Plant Pressure Relief Devices,' 
§1.3.3, 'Test Frequency, Class 1 
Pressure Relief Devices.' 


Table A.l continued on next page 


’During the initial 5 year period, no testing is required during the first 12 months. Testing shall be performed on 
a minimum 25% of the valves of each type and manufacture during each following 12 month interval such that at the 
end of 24 months of operation 25% have been tested, 50% in 36 months, 75% in 48 months, and 100% in 60 months. 
Additionally, during any running 24 month period a minimum of 20% of the valves (previously untested, if they exist) 
shall be tested. 

^Subsequent updates to 'The Operations and Maintenance of Nuclear Power Plants' have occured but the 1989 
Edition is referenced in 10 CFR §50.55a(b). 




Table A, 1 continued from previous page 

Description ^ 

Discussion 

r'w'i 

In-Service testing of safety re¬ 
lated pumps and valves. 

All safety related pumps and 
valves are required to be tested 
for operability on a quarterly 
basis. Under certain circum¬ 
stances, tests which cannot be 
conducted at power can be des¬ 
ignated as either cold shutdown 
tests or refueling tests and be 
deferred to the next outage. 
Neither require prior NRC ap¬ 
proval but they must be justi¬ 
fied, augmented by risk-based 
arguments, and are auditable. 

ASME Boiler & Pressure Vessel 

Code, Section XI, 'Rules for In- 
Service Inspection of Nuclear 
Power Plant Components.' 

Periodic testing of motor oper¬ 
ated valves (MOVs) in safety 
related systems. 

NRC requires all MOVs in 
safety related systems to be di¬ 
agnostically tested and, where 
practical, tested to their design 
basis condition. Testing inter¬ 
val is determined by combin¬ 
ing the risk significance and 
failure rate. 

ASME Boiler & Pressure Ves¬ 
sel Code, Section XI, 'Rules 
for In-Service Inspection of 
Nuclear Power Plant Compo¬ 
nents' supplemented by NRC 
Generic Letter 96-05, 'Periodic 
Verification of Design-Basis 
Capability of Safety-Related 
Motor-Operated Valves,' 

issued September 18,1996. 

Engineered safety feature ac¬ 
tuation tests (integrated tests 
which involve the complete 
safety signal path from sensor 
to system actuation). 

These tests are currently per¬ 
formed each outage and are 
typically segregated into three 
tests: engineered safeguards 
actuation, containment isola¬ 
tion, and core cooling. 

Numerous NRC and ASME 
regulations apply. 

Table AA continued on next page 
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page 


Description: 

Discussion 

Basis 

Steam generator eddy current 
testing. 

Steam generator eddy current 
testing is currently performed 
shutdown at 18-24 month 
intervals. NRC inspection 

guidelines for steam genera¬ 
tors allows for periods between 
steam generator eddy current 
testing of up to 40 months, 
after two previous successful 
inspections at shorter intervals. 

Numerous NRC, ASME, and 
industry regulations and rec¬ 
ommendations apply. NRC let¬ 
ter SECY-00-0078, 'Status and 
Plans for Revising the Steam 
Generator Tube Integrety Reg¬ 
ulatory Framework,' dtd 30 
March, 2000, indicates the in¬ 
tent for the NRC to accept 
the recommendations and in¬ 
spection procedures contained 
in the Nuclear Energy Insti¬ 
tute (NEI) initiative, NEI 97- 
06, 'Steam Generator Program 
Guidelines.' 

Periodic testing of ASME 
Class 2 relief valves used in 
non-primary pressure bound¬ 
ary applications. 

All valves of each type and 
manufacture shall be tested 
within each subsequent^ 10 
year period with a minimum of 
20% of the valves tested within 
any 48 months. This 20% shall 
be previously untested valves, 
if they exist. 

Investment protection based. 
Testing is governed by 'The 
Operation and Maintenance 
of Nuclear Power Plants,' 
ASME/ANSI OM-1989^ Part 
1, 'Requirements for Inser¬ 
vice Performance Testing of 
Nuclear Power Plant Pressure 
Relief Devices,' §1.3.4, 'Test 
Frequency, Classes 2 and 3 
Pressure Relief Devices.' 

Table A.l continued on next page 


^During the initial 10 year period, no testing is required during the first 24 months. Testing shall be performed on 
a minimum 25% of the valves of each type and manufacture during each following 24 month interval such that at the 
end of 48 months of operation 25% have been tested, 50% in 72 months, 75% in 96 months, and 100% in 120 months. 
Additionally, during any running 48 month period a minimum of 20% of the valves (previously untested, if they exist) 
shall be tested. 

"^Subsequent updates to 'The Operations and Maintenance of Nuclear Power Plants' have occured but the 1989 
Edition is referenced in 10 CFR §50.55a(b). 
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Description r; 

Discussion 

. . Basis 

Condenser waterbox inspec¬ 
tion and cleaning. 

The primary degredation 
mechanism of the heat trasfer 
capability of the condenser is 
the fouling and clogging of 
the condenser inlet tube sheets 

and tube surfaces from either 
debris or marine growth. 

Investment protection based 
to maintain plant thermody¬ 
namic efficiency. Numerous 
orgaiuzations (Occupational 
Safety and Health Adminis¬ 
tration (OSHA), Employee's 
Union, etc.) address persormel 
safety issues. 

Control rod drop and position 
indication testing 

Control and shutdown rod 
drop testing is currently per¬ 
formed following refueling to 
guarantee that the control rods 
have an unimpeded path to the 
bottom of the core and that 
maximum drop times are con¬ 
sistent with the assumed drop 
times used in the plant safety 
analysis. No upper limit to 
testing frequency is specified 
by the NRC, primarily since 
no current plant operates on 
a long fuel cycle where fuel 
swelling (leading to control rod 
binding) is of concern. Posi¬ 
tion indication testing is cur¬ 
rently deferred since chemi¬ 
cal reactivity control is used 
and the control rods are fully 
withdrawn for the duration of 
the operating cycle (no position 
uncertainty). 

Numerous NRC regulations in¬ 
cluding 'NRC Improved Stan¬ 
dard Technical Specifications.' 

Table A.l continued on next page 
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Description ^ V 

!, Discussion 

Basis 

Electrically operated safety 
component circuit breaker 
overcurrent relay checks 

Overcurrent relay checks of 
electrically operated safety 
component circuit breakers 
(primarily pumps) is per¬ 
formed periodically to ensure 
that a bound safety component 
will trip off-line not be sensed 
by the safeguards systems as 
being in operation. 


Main turbine lubricating oil 
system low-pressure trip 
switch calibration. 

Calibration of the main tur¬ 
bine low shaft pump discharge ^ 
pressure and low bearing oil 
pressure switches require the 
main turbine to be shutdown. 

Vendor provided investment 
protection. 

Main turbine electrohydraulic 
control (EHC) system clean 
and inspect. 

A complete EHC system clean 
and inspect, including soft¬ 
ware and filter replacement, is 
required at less than four-year 
intervals (typically 24 months). 
This maintenance requires the 
main turbine to be shutdown. 

Vendor provided investment 
protection. Can be performed 
on-line if a non-zero steam de¬ 
mand (i.e., from a steam dump 
or large auxiliary loading) can 
be provided. 






Table A.2: Identified Maintenance Barriers Requiring Re¬ 
duced Power 


Description 

. Discussion 

Basis 

Steam and feedwater flow me¬ 
ter calibrations. 

Requires the applicable steam 
generator to be secured. 

Investment protection. 

Feedwater control valve indi¬ 
cation and stroke check. 

Requires the applicable steam 
generator to be secured. 

Investment protection. 

Feedwater isolation valve 

stroke check. 

Requires the applicable steam 
generator to be secured. 

Investment protection. Regu¬ 
latory based if feedwater iso¬ 
lation valve closure is part of 
safety system actuation. 

Hydraulically operated valve 
fluid change. (Main steam 
isolation valves and feedwater 
isolation valves are typically 
hydraulically operated.) 

Requires the applicable steam 
generator to be secured. 

Investment protection. 

Main feed pump governor cal¬ 
ibration. 

Requires steam demand to be 
reduced to the capacity of re¬ 
maining main feed pump(s). 

Investment protection. 

Main steam isolation valve 

stroke check. 

Does not require complete 
stroke, and causes only a small 
reduction in steam flow. Steam 
demand typically reduced 
sufficiently to prevent over¬ 
steaming remaining generators 
if valve inadvertently closes 
fully. 

Investment protection. 

Table A.2 continued on next page 
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Description 

Discussion 

Basis 

Component cooling water sys¬ 
tem pump maintenance. 

Requires total system heat load 
to be reduced to the capacity 
of remaining component cool¬ 
ing water system pump(s). 

Investment protection. 

Heat exchanger inlet traveling 
screen clean and inspect. 

Requires heat exchanger to be 
secured. Total system heat load 
is required to be reduced to the 
capacity of the remaining heat 
exchanger(s). 

Investment protection. 






Table A.3; Identified Maintenance Barriers to Eight-Year Op¬ 
erating Cycle® 


.. Description f . 

Discussion 

Basis 

Electrical switchgear clean 
and inspect including motor- 
operated valve inspections and 
cable meggers, starter checks, 
breaker inspections, unique 
features testing, and visual 
inspections. 

Encompasses a large num¬ 
ber (over 450) of vmspecified 
surveillances with periodicities 
between 48 and 96 months. 
Shutdown may be required to 
permit accessibility or when 
entire (vital) switchboards 
must be secured. 

Investment protection; fire 
safety. 

Periodic maintenance of 

non-safety system manu¬ 
ally operated valves. Scope 
is t)rpically disassemble- 

inspect-reassemble followed 
by functional testing. 

Periodicity established by ven¬ 
dor, typically between 48 and 
72 months. May require shut¬ 
down if valve cannot be iso¬ 
lated from system. 

Investment protection. 

Reactor coolant system and 
containment integrated leak 
rate testing. 

Extent and frequency based on 
material history. 

ASME Boiler & Pressure Vessel 

Code, Section XI, 'Rules for In- 
Service Inspection of Nuclear 
Power Plant Components.' 

Main turbine trip and throttle 
valve inspection. 

Major valves in the main tur¬ 
bine steam supply path are typ¬ 
ically inspected at 48-60 month 
intervals. 

Vendor provided investment 
protection. 

Fire station and snubber in¬ 
spections. 

Typically performed at 48- 
60 month intervals. Some 

stations inside containment are 
not accessible at power. 

Investment protection; fire 
safety. 

Table A3 continued on next page 


^Includes all known barriers identified in Table A.l. 
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Description 

. Discussion 

Basis 

Control rod drive mechanism 
(CRDM) motor-generator 

set mechanical and electrical 

maintenance. 

Requires motor-generator set 
to be secured. T)q)ically per¬ 
formed at 54 month intervals. 

Investment protection. 

Charging pump mechanical 
and electrical maintenance. 

Performed at 48-72 month in¬ 
tervals. Requires shutdown if 
insufficient charging capacity 
is available. 

Investment protection and reg¬ 
ulatory based. 

Main turbine generator (gener¬ 
ator end) electrical inspections. 
Includes stator visual inspec¬ 
tion and megger, and exciter 
inspection and megger. 

Typically performed at 

54 month intervals. 

Vendor provided investment 
protection. 
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